|
Hola, I have two scenarios in the i need use this functionality: 1. I need to fill one record in two moments, in the first one user complete the half and this user can't modify this record anymore, in second moment other user complete the other half record and just fill the record no have more edition options, but two users can see the record (no editing, but can see), if i put somes records, 10 by example, each record have Miscellaneous states of editions. 2. In accounting systems (and mabe other systems) is necesary manage periods of closures but if posible for one user see the records closed, and edit records in open state, and can be in the same list. This are my scenarios, Benjamín rbarton escribió: Soren, The action-based authorization can be done at two levels: the controller (uses *_authorized? in controller file, applies to the action on every column for that user's view) and the model (uses authorized_for_*? in model file, applies to each record individually). Your sample code using 'self' would work in the model authorization, but not in the controller one. (Also check your logic, in your example the second line would never be evaluated since the first line always returns something.)Again see http://activescaffold.com/docs/security for reference. Also, if you define a controller-based authorization method for an action, none of the model-based authorization calls will be made for that action unless you call 'super' at the end. So make sure if you're testing it at the model level that there's not a controller method getting in your way for that action... Ryan On Feb 26, 1:33 pm, Soren <[email protected]> wrote:Like Ben I have the same issue. Depending on the data on a particular line in the list view I need to enable/disable some of the links. I can define the following in the corresponding controller: protected def update_authorized? return false unless current_user.role == 'admin' end def delete_authorized? return false unless current_user.role == 'admin' end This does not take into account the particular record, so how do we get access to that record. The wiki shows an example but it does not show how to get access to the details of each record. I tried something like def update_authorized? return (self.user_id == current_user.id) return false unless current_user.role == 'admin' end But as far as I get it the self is not the record. So what structure do I need to check in order to get access to the current record ? /S On Feb 26, 9:15 am, Benjamín Cárdenas Salamandra <[email protected]> wrote:hola, yes is enough with enable/disable action, thanks, and i don't now over this implementation, just two months ago i needed it and i read all AS documentation and not see that, and not take time to hack this functionality (sorry if i say some incorrect, my english writing is very bad), Benjamín rbarton escribió:Closer, Benjamin, You can apply model-based authorization to enable/disable action links on a per-record basis, see the very bottom of that security wiki page for an example. Now if disabling is not good enough, you want the entire link text to disappear, you'll have to override the _list_actions partial for that controller, and filtering out the link rendering part explicitly. Start by copying the default one out of the AS directory structure (active_scaffold/frontends/default/views/_list_actions.rhtml) and putting it in your controller directory, then edit and test as needed. Ryan On Feb 25, 3:49 pm, Benjamín Cárdenas Salamandra<[email protected]>wrote:Hola, I need the same functionality too, is better try to implement in the edge, no? Benjamín Closer escribió:Hi,I want to hide some action links (see attachmenthttp://download.maksd.ru/hide _some_actions.png). How can I do it?Thanks, Maxim Dobriakov --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~--- |
Re: How can I hide some action links for some record?
Benjamín Cárdenas Salamandra Thu, 26 Feb 2009 11:17:25 -0800
