Re: How to restrict viewing/modifying other users data?

Frederick Cheung
2008-09-24T20:37:51Z

On Sep 24, 8:57 pm, Nathan
<ngilmore...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
wrote:
> Hi Everyone.  I am working on my first Ruby on Rails app.  It is a
> basic project management application.  I have user login/logout
> functionality set up.  It will only display a list of projects that
> are linked to the logged in user.  However, if someone else logs in
> and types in a url such aswww.projectmanagement.com/projects/17
> (where 17 is a project id), they will be able to see that project even
> if they are not linked to it.  What is the best design approach to
> this problem?
>
Instead of doing Project.find do current_user.projects.find
This restricts the find to projects owned by that user.

Fred
> Thank you for any advice!!!
>
> Nathan