http://wiki.github.com/activescaffold/active_scaffold/per-request-configuration
in your controller you need to do
before_filter :update_table_config
def update_table_config
if current_user.admin # or whatever
active_scaffold_config.actions.add :list
else
active_scaffold_config.actions.exclude :list
end
end
On Wed, May 13, 2009 at 7:21 PM, Soren <[email protected]> wrote:
>
> Hi,
>
> I have a pretty standard restful authentication setup with restful
> authentication. So a users and a session controller.
>
> My users model is extended with a lot of profile information about the
> users. This information they can edit through an embedded scaffold
> that only shows then their own data.
>
> But the clever user might navigate to /users/list and can there see
> all of the users which on this site is an undesirable action. And I do
> actually use the /users/list page for the admin interface.
>
> So the question to the group is:
>
> How do I secure the /users/list page such that admin has access to it,
> but non-admins still have access to the embedded scaffold (and thereby
> the list).
>
> /S
>
>
> >
>
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
