Thanks. Now I understand.
On Oct 2, 12:52 am, "Sergio Cambra .:: entreCables - Symbol Servicios
Informáticos S.L. ::." <[EMAIL PROTECTED]> wrote:
> El Thursday 02 October 2008 09:32:34 Sergio Cambra .:: entreCables - Symbol
> Servicios Informáticos S.L. ::. escribió:
>
>
>
> > El Wednesday 01 October 2008 23:22:56 WW escribió:
> > > After looking through, in detail, of the security layer in AS, I just
> > > want to make sure that I have the right understanding.
>
> > > It seems to me that #{action_name}_authorized? methods in your
> > > controller will remove the links from AS unless you are authorized to
> > > see it. However, it does not prevent an user from initiating that
> > > action.
>
> > > For example, if I have an action link named backup_data, this action /
> > > method will have to be public to be accessible by an action url. I
> > > can create a backup_data_authorized? method in the controller, and
> > > this will hide / show the action link to the proper authorized user.
> > > However, I can manually access that action through the URL
> > >http://ruby/controller/backup_dataand it will actually run the
> > > action.
>
> > > Therefore, my conclusion is that the security layer at the controller
> > > level for AS prevents the users from seeing the actions links, but to
> > > really secure the action, you will need additional layer to protect
> > > the action from being executed.
>
> > > Can someone confirm this? Or am I using AS security incorrectly?
>
> > > Thank you.
>
> > I think it's a bug in AS, because #{action_name}_authorized? are added as
> > before_filter, but a before_filter needs redirect or render something to
> > prevent an action, and you can't redirect or render in methods used in a
> > view.
>
> I have thought about this, you can render o redirect only when action is not
> performed and it should work to halt the request and hide the links:
> def #{action_name}_authorized?
> if <condition>
> true
> else
> render :nothing => true, :status => 403 unless performed?
> false
> end
> end
>
> --
> Sergio Cambra .:: entreCables - Symbol Servicios Informáticos S.L. ::.
> Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza
> T) 902 021 404 F) 976 52 98 07 E) [EMAIL PROTECTED]
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
