Rails - Feb 2007 - is it necessary ?

hi, i''ve a simple question. i''m developing a simple
application in which
i''ve an users and news controllers plus models (users and news). a news
have an user and must be exist, to write a news the user must be logged
and when he sends the news i create it setting the news.user_id
session[:user_id]
ok, i think for now is correct
but the real question is: now i''ve in the news validate something like
this:
errors.add(:user_id, ''is not valid'') if !self.user, do you
think is
necessary ? i don''t know, because i set it in the controller, but is
possible by other ways to send (with an own made form) the form with a
different user_id (i set it before create the object, so i think is
impossible, but i don''t know)?

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

> errors.add(:user_id, ''is not valid'') if !self.user, do
you think is
> necessary ? i don''t know, because i set it in the controller, but
is
> possible by other ways to send (with an own made form) the form with a
> different user_id (i set it before create the object, so i think is
> impossible, but i don''t know)?
Setting the user from the session should be safe.  Session data cannot
be manipulated by spoofing a form.  But its a good idea for the model
to validate the presence of a user_id.  You can do this with
validates_presence_of (easier than writing a custom validation).

validates_presence_of :user_id

Aaron


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---