El Sunday 11 January 2009 20:02:44 [email protected] escribió: > I have a number of models: users, households, bills. They are > hierarchically related in the sense that a 'user' has many > 'households' and a 'household' has many 'bills'. I have enabled active > scaffold on each of the three controllers: users_controller, > households_controller and bills_controller. > > I want users to be able to modify only their own records, for any of > the models. So - in the users_controller, i've used > 'conditions_for_collection' to ensure that when a user navigates to > the url: /foo_app/users, they see only themselves listed. From their > own user row, they can access the nested models households and bills, > in each case, seeing only those records that are descendants of > themselves (not of other users). > > The problem I have si that there's a huge security hole: if a user > navigates to the url: /foo_app/bills, they can see all the bills for > all the users and for all the households. > > What's the simplest way to preclude this? I've been struggling with > it for a while. I can create 'conditions_for_collection' methods for > the households model and the bills model (in addition to the one that > i've created for the users model), but this quickly gets unwieldy > (both because I actually have more than just two descendant models and > because it's non trivial to get the conditions for association when > there are multiple levels of hierarchy between the model of interest > and the user model). > > Anything that I do to try to restrict access to the controller at a > higher level, has the result of restricting access even when I come to > the controller through the proper routs (user->household->bill).
Look at security in github wiki (model methods): http://wiki.github.com/activescaffold/active_scaffold/security You should add authorized_for_#{action} to household and bill models, for all actions probably. > > Is there some way to tell AS that it should only allow access to a > model through its parent (or its parent's parent and so on), as > opposed to directly? > > Yoram > -- Sergio Cambra .:: entreCables - Symbol Servicios Informáticos S.L. ::. Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza T) 902 021 404 F) 976 52 98 07 E) [email protected] --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
