[Rails] Re: Re: acl_system help is needed

Josh Kieschnick
Mon, 17 Jul 2006 12:49:54 -0000

>
> I think you have the right idea. You need to make sure that a user
> has authenticated before you let the access_control filter run. So
> only use access_control on actions in your controller that require
> user login.  If one of your controller actions doesn''t need a user
to
> log in to see , then it doesn''t need to perform access_control
either.
>
>
> -Ezra

thanks for the reply Ezra. for this particular controller, i need all of
the pages to perform access control. all i have in it now is the code
that is generated when you create a scaffold, plus this:

  before_filter :authorize

  access_control :DEFAULT => ''customer | csr'',
                 :authorize => ''!guest''

the authorize method is in my application.rb file and all it does is
check to see if there is someone logged in and then sends the user to
the login controller that i have set up.

i had this in my controller:

  def current_user
    User.find_by_id(session[:user_id])
  end

but this was being executed before my authorize method so when the
acl_system checks my current user, it returns nil. to at least keep the
code from from giving errors i had to change my current_user method to:


  def current_user
    User.find_by_id(session[:user_id]) || User.new
  end

but even by doing that, my authorize method is not getting called and
the user is not ever being sent to the login screen. if i go straight to
the login screen and login, everything else works great.

also, on a side note, i wanted to add the current user method to the
base controller file but it''s not pulling up that way. is it required
to
have current_user in every single controller?