Re: How to restrict viewing/modifying other users data?

CPerry
2008-09-24T20:41:02Z

Actually, nevermind. Frederick posted exactly what I was coming back
to post!

--Cory

On Sep 24, 4:39 pm, CPerry <c...-jEJZ73ctDLTqlBn2x/YWAg@public.gmane.org>
wrote:
> I would think a simple before_filter would work for you that would
> require a login before those projects could be viewed. Once they
> login, they would only be able to see the projects that they are
> assigned to.
>
> Your before_filter would be placed up top in the controller for
> projects.
>
> Something like this....
>
> before_filter :login_required, :only =>
> [:new, :create, :edit, :update]
>
> Then you could add all of the other actions that required a login as
> well such as :show, :add, :edit, :delete, etc., etc. I am certainly no
> Rails genius yet, but I think this would work for you.
>
> --Cory
>
> On Sep 24, 3:57 pm, Nathan
<ngilmore...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>
> > Hi Everyone.  I am working on my first Ruby on Rails app.  It is a
> > basic project management application.  I have user login/logout
> > functionality set up.  It will only display a list of projects that
> > are linked to the logged in user.  However, if someone else logs in
> > and types in a url such aswww.projectmanagement.com/projects/17
> > (where 17 is a project id), they will be able to see that project even
> > if they are not linked to it.  What is the best design approach to
> > this problem?
>
> > Thank you for any advice!!!
>
> > Nathan