search for: model_secur

Hi, I''m building an application which is going to require quite fine grained access control. Deciding if a user is allowed to access an action will probably require checking quite number of different rules, so a simple role-based system won''t be flexible enough. The approach I think I will try first is, if it''s possible, to ignore permission issues inside the

Howdy, I''m writing an ''edit profile'' screen. I was writing some tests first (yay!), and I realized that, if you were smart, you could use the edit form to change your username. I know I could use attr_protected on username, but that would still allow for usernames to be changed (abeit not through the form). How can I make the username read only AFTER the object has