El Monday 23 March 2009 16:10:29 Kenny Ortmann escribió: > active scaffold conditions for collection is only supposed to be used to > limit the list, not to be used for not allowing viewing. > > you need to but a before filter on the show action that directs the user > away if they don't own the project. you should change the before destroy > before update and before creates to also use a before filter.
You can define authorized_for_read?, authorized_for_destroy? and authorized_for_update? in your model to check user_id==current_user.id ActiveScaffold actions check permissions with that methods. > > On Mon, Mar 23, 2009 at 7:26 AM, confusedVorlon <[email protected]>wrote: > > Hi Folks, > > > > I have a scaffold which shows strings, and I'm using it to expose a > > REST API for developers who will access/modify the strings. > > > > the strings belong to a project, which in turn belongs to a user > > > > > > I'm using conditions_for_collection to show only the strings that > > belong to users: > > > > def conditions_for_collection > > ['projects.user_id = (?)', current_user.id] > > end > > > > and I control access to update/destroy/create in my model > > > > before_destroy :check_this_is_owner > > before_update :check_this_is_owner > > before_create :check_create_project_permission > > > > which leaves one hole - any user can still use show/:id to show any > > string whether it is theirs or now. > > > > e.g. I can go to > > site/strings/4 which will show string 4 - even though string 4 belongs > > to a project of which I am not the owner > > > > Is there a standard way to prevent this? > > > > thanks in advance > > > > Rob > > -- Sergio Cambra .:: entreCables S.L. ::. Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza T) 902 021 404 F) 976 52 98 07 E) [email protected] --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
