Hi, I have a pretty standard restful authentication setup with restful authentication. So a users and a session controller.
My users model is extended with a lot of profile information about the users. This information they can edit through an embedded scaffold that only shows then their own data. But the clever user might navigate to /users/list and can there see all of the users which on this site is an undesirable action. And I do actually use the /users/list page for the admin interface. So the question to the group is: How do I secure the /users/list page such that admin has access to it, but non-admins still have access to the embedded scaffold (and thereby the list). /S --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
