Soren, The action-based authorization can be done at two levels: the controller (uses *_authorized? in controller file, applies to the action on every column for that user's view) and the model (uses authorized_for_*? in model file, applies to each record individually). Your sample code using 'self' would work in the model authorization, but not in the controller one. (Also check your logic, in your example the second line would never be evaluated since the first line always returns something.)
Again see http://activescaffold.com/docs/security for reference. Also, if you define a controller-based authorization method for an action, none of the model-based authorization calls will be made for that action unless you call 'super' at the end. So make sure if you're testing it at the model level that there's not a controller method getting in your way for that action... Ryan On Feb 26, 1:33 pm, Soren <[email protected]> wrote: > Like Ben I have the same issue. Depending on the data on a particular > line in the list view I need to enable/disable some of the links. > > I can define the following in the corresponding controller: > protected > > def update_authorized? > return false unless current_user.role == 'admin' > end > > def delete_authorized? > return false unless current_user.role == 'admin' > end > > This does not take into account the particular record, so how do we > get access to that record. > > The wiki shows an example but it does not show how to get access to > the details of each record. > I tried something like > > def update_authorized? > return (self.user_id == current_user.id) > return false unless current_user.role == 'admin' > end > > But as far as I get it the self is not the record. > So what structure do I need to check in order to get access to the > current record ? > > /S > > On Feb 26, 9:15 am, Benjamín Cárdenas Salamandra <[email protected]> > wrote: > > > hola, > > yes is enough with enable/disable action, thanks, and i don't now over this > > implementation, just two months ago i needed it and i read all AS > > documentation and not see that, and not take time to hack this > > functionality (sorry if i say some incorrect, my english writing is very > > bad), > > Benjamín > > rbarton escribió:Closer, Benjamin, You can apply model-based authorization > > to enable/disable action links on a per-record basis, see the very bottom > > of that security wiki page for an example. Now if disabling is not good > > enough, you want the entire link text to disappear, you'll have to override > > the _list_actions partial for that controller, and filtering out the link > > rendering part explicitly. Start by copying the default one out of the AS > > directory structure > > (active_scaffold/frontends/default/views/_list_actions.rhtml) and putting > > it in your controller directory, then edit and test as needed. Ryan On Feb > > 25, 3:49 pm, Benjamín Cárdenas Salamandra<[email protected]>wrote:Hola, I > > need the same functionality too, is better try to implement in the edge, > > no? Benjamín Closer escribió:Hi,I want to hide some action links (see > > attachmenthttp://download.maksd.ru/hide_some_actions.png). How can I do > > it?Thanks, Maxim Dobriakov --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
