After looking through, in detail, of the security layer in AS, I just
want to make sure that I have the right understanding.
It seems to me that #{action_name}_authorized? methods in your
controller will remove the links from AS unless you are authorized to
see it. However, it does not prevent an user from initiating that
action.
For example, if I have an action link named backup_data, this action /
method will have to be public to be accessible by an action url. I
can create a backup_data_authorized? method in the controller, and
this will hide / show the action link to the proper authorized user.
However, I can manually access that action through the URL
http://ruby/controller/backup_data and it will actually run the
action.
Therefore, my conclusion is that the security layer at the controller
level for AS prevents the users from seeing the actions links, but to
really secure the action, you will need additional layer to protect
the action from being executed.
Can someone confirm this? Or am I using AS security incorrectly?
Thank you.
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
