EXCELLENT !
PM - this was exactly what I needed.
Thanks a bunch - I knew good things would come from a post to this
community.
/S
Kenny Ortmann wrote:
Oh wait sorry.
So when you are on the user page and you render the embedded scaffold
are you passing in constraints?
active scaffold tries to do some magic when it renders lists and
embedded scaffolds.
If you are on a url that looks like this
/users/6/cars
it will automatically apply a constraint to your cars scaffold that
says user_id = 6
in your controller you can do this
def conditions_for_collection
if user.admin
[]
else
['user_id = #{user.id}']
end
end
So if the user is an admin we don't restrict the list view, but if the
user is normal then we only show the item(s) for that user.
~Kenny
On May 13, 6:32 pm, Kenny Ortmann <[email protected]> wrote:
> http://wiki.github.com/activescaffold/active_scaffold/per-request-con...
>
> in your controller you need to do
>
> before_filter :update_table_config
>
> def update_table_config
> if current_user.admin # or whatever
> active_scaffold_config.actions.add :list
> else
> active_scaffold_config.actions.exclude :list
> end
> end
>
> On Wed, May 13, 2009 at 7:21 PM, Soren <[email protected]> wrote:
>
> > Hi,
>
> > I have a pretty standard restful authentication setup with restful
> > authentication. So a users and a session controller.
>
> > My users model is extended with a lot of profile information about the
> > users. This information they can edit through an embedded scaffold
> > that only shows then their own data.
>
> > But the clever user might navigate to /users/list and can there see
> > all of the users which on this site is an undesirable action. And I do
> > actually use the /users/list page for the admin interface.
>
> > So the question to the group is:
>
> > How do I secure the /users/list page such that admin has access to it,
> > but non-admins still have access to the embedded scaffold (and thereby
> > the list).
>
> > /S
>
>
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
