> [mailto:[EMAIL PROTECTED] On Behalf Of Chris Renner > Now, this fix for this can be easy: in my action, unset those > fields I > don't want to be writable. But it seems like there must be better way > to do it... based on user roles in the before_filter perhaps? Or even > in the model? What's the philosophy here? Should controllers have > unfettered access to all fields of a model, or should access > be limited > from the model?
How about the idea of dynamically setting the model's beforeValidate in the controller, based on the action? So for admin_edit() you would set it to beforeValidateAdmin, which allows security_level to be set, and for edit() you would keep the default beforeValidate, which invalidates the form (and possibly triggers a security response) if security_level is set. -- Regards, Ryan Ginstrom --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Cake PHP" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php -~----------~----~----~----~------~----~------~--~---
