AS can call that method without the record being loaded yet. Use the AS helper method 'existing_record_check' to account for this.
Check out Tips for Defining Model Security Methods on the security page of the API docs... http://activescaffold.com/docs/security Ryan On Feb 26, 3:28 pm, Soren <[email protected]> wrote: > actual code w Logger instrumentation: > > def authorized_for_update? > > SCLOG.info(current_user.inspect) > SCLOG.info(self.inspect) > > if (current_user.role == 'admin') > return true > else > return (self.user_id == current_user.id) > end > end > > Log output: > > #<User id: 46, login: "test", role: "user", email: "test", > crypted_password: "xxx", salt: "xxx", created_at: "2009-02-26 > 08:54:38", updated_at: "2009-02-26 11:58:49", remember_token: nil, > remember_token_expires_at: nil, activation_code: nil, activated_at: > "2009-02-26 16:54:45", state: "active", deleted_at: nil, first_name: > "test", last_name: "test", address: "address", city: "city", zip: 0, > home_phone: nil, cell_phone: nil, work_phone: nil, drivers_license: > nil, license_expiration: nil, car1_id: nil, car2_id: nil, spouse_id: > nil> > #<Student id: nil, created_at: nil, updated_at: nil, first_name: nil, > last_name: nil, address: nil, city: nil, zip: nil, email: nil, > home_phone: nil, cell_phone: nil, klass_id: nil, user_id: nil> > > Which means that the self object is not set but we happen to know that > it is of the correct type. > > Is there a bug here in AS ? > > /S > > On Feb 26, 11:18 am, rbarton <[email protected]> wrote: > > > Personally, I would add a logger.info 'got here' line to the top of > > the method, then add another logger.info with details on the two > > variables you're comparing after the 'else' to see what's going on... > > > One other thing--you should probably check to make sure that > > current_user exists before using it. See the API... > > > Ryan > > > On Feb 26, 2:04 pm, Soren <[email protected]> wrote: > > > > Sorry - very much a sleep here > > > > The entry has to go to the model not to the controller. And then the > > > name has to be right too - guess I need some more coffee. > > > Here is an entry that mostly works for me: > > > > in model: > > > > protected > > > > def authorized_for_update? > > > if (current_user.role == 'admin') > > > return true > > > else > > > return (self.user_id == current_user.id) > > > end > > > end > > > > BUT - how come the comparison of user_id's does not work ? Did I goof > > > again ? > > > > /S > > > > On Feb 26, 10:33 am, Soren <[email protected]> wrote: > > > > > Like Ben I have the same issue. Depending on the data on a particular > > > > line in the list view I need to enable/disable some of the links. > > > > > I can define the following in the corresponding controller: > > > > protected > > > > > def update_authorized? > > > > return false unless current_user.role == 'admin' > > > > end > > > > > def delete_authorized? > > > > return false unless current_user.role == 'admin' > > > > end > > > > > This does not take into account the particular record, so how do we > > > > get access to that record. > > > > > The wiki shows an example but it does not show how to get access to > > > > the details of each record. > > > > I tried something like > > > > > def update_authorized? > > > > return (self.user_id == current_user.id) > > > > return false unless current_user.role == 'admin' > > > > end > > > > > But as far as I get it the self is not the record. > > > > So what structure do I need to check in order to get access to the > > > > current record ? > > > > > /S > > > > > On Feb 26, 9:15 am, Benjamín Cárdenas Salamandra <[email protected]> > > > > wrote: > > > > > > hola, > > > > > yes is enough with enable/disable action, thanks, and i don't now > > > > > over this implementation, just two months ago i needed it and i read > > > > > all AS documentation and not see that, and not take time to hack this > > > > > functionality (sorry if i say some incorrect, my english writing is > > > > > very bad), > > > > > Benjamín > > > > > rbarton escribió:Closer, Benjamin, You can apply model-based > > > > > authorization to enable/disable action links on a per-record basis, > > > > > see the very bottom of that security wiki page for an example. Now if > > > > > disabling is not good enough, you want the entire link text to > > > > > disappear, you'll have to override the _list_actions partial for that > > > > > controller, and filtering out the link rendering part explicitly. > > > > > Start by copying the default one out of the AS directory structure > > > > > (active_scaffold/frontends/default/views/_list_actions.rhtml) and > > > > > putting it in your controller directory, then edit and test as > > > > > needed. Ryan On Feb 25, 3:49 pm, Benjamín Cárdenas > > > > > Salamandra<[email protected]>wrote:Hola, I need the same > > > > > functionality too, is better try to implement in the edge, no? > > > > > Benjamín Closer escribió:Hi,I want to hide some action links (see > > > > > attachmenthttp://download.maksd.ru/hide_some_actions.png). How can I > > > > > do it?Thanks, Maxim Dobriakov --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
