similar to: REST Routing issue

what''s the best protection against someone trying to modify an URL in a named route /users/25/posts if the user enter another URL /users/26/posts, he can get acces to user 26 posts unless .. a before_filter is checking the current_user ID but is there any other way to do it ? thanks for your lights kad -- Posted via http://www.ruby-forum.com/.

I am trying to write a nested route ''new style'' map.resources :franchises, :has_many => :documents in place of the : map.resources :franchises do |franchises| franchises.resources :documents, :name_prefix => "franchise_" end but get an error : no route found to match "/franchises/1/documents" with {:method=>:get} running rake routes,

I read the following tag in teh Beast example <%= submit_tag''Login'', :or => link_to_function(''forgotten password'', "$(''reset-password'').toggle();") %> I understand the link_to_function, but what is this :or parameter used for ? the link doesn''t appear, so it cannot be used... thanks for your lights kad --

I can sent my own action to a users_controller stating in routes.rb map.resources :users, :member => { :network => get } I defined in my users_controller the network action.... so I can have an url like "http://localhost:3000/users/168.xml;network" now I would like to have another action network_plus which is a little bit different fron the network.. sure, I can state another

In a panel, I have an hidden input field which is modified by a javascript function (from calendar) how can I sent the value of this input field in my link_to_remote call ? presently I just send back one parameter (an id) but I need both... <input type="hidden" name="booking[start_at]" id="f_date_s" value="booking[start_at]" /> ... <%=

I have an ''account_controller.rb'' in an ''admin'' module I list the accounts with : http://0.0.0.0:3000/admin/accounts/list, and get my table trying to sort it, I use the follwoing sort_link_helper : def sort_link_helper(text, param) key = param key += "_reverse" if @params[:sort] == param options = { :url =>

I am trying to use the new Rails 2.0 macro : rescue_from class PostsController < ApplicationController rescue_from ActiveRecord::RecordNotFound, :with => :deny_access ... def show @post = Post.find_by_id(params[:id]) raise ActiveRecord::RecordNotFound if @post.nil? #illegal access ..... end def deny_access respond_to do |format| format.html end end but the

I tried to use named parameters in my SQL query , using find_by_sql Order.find_by_sql ([select * from orders where amount > ? and quantity > ?", [ @amount, @quantity ] works;.. but Order.find_by_sql ([select * from orders where amount > :amount and quantity > :quantity ", [ :amount => @amt, :quantity => @qty ] is not working a I wrong or should I use a plain select

OS X 10.4.8 I am sending an email via Actionmailer settings are written correctly in environment.rb ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.raise_delivery_errors = :true ActionMailer::Base.perform_deliveries = :true ActionMailer::Base.default_charset = "utf-8" ActionMailer::Base.server_settings = { :address => "mail.mydomain.com", :port => 25,

in my booking / _form I have the following input fields : (startdate and endate) <div> <label for="startdate">Booking Start Date</label><br /> <%= text_field_tag(''startdate'', @startdate, {:class => @startdateclass, :readonly => "readonly", :maxlength => "25"} ) %> <%= observe_field("startdate",

In one of my view , I have an image the user need to click to close a <div>selections</div> added by an Ajax call. if I use : <img src ="/images/icon_closeitem.gif", size="16*16", border="0",alt="Close Selection", title="Close", onclick="<%= remote_function(:url => { :controller => ''property'',

Is there any way to display a default message value ''Select'' rather tha an empty value when using this option ? kad -- Posted via http://www.ruby-forum.com/.

As I am in development environment, I wrote in my config/environment.rb ActionController::Base.consider_all_requests_local = false in my application.rb, I wrote def rescue_action_in_public(exception) case exception when RoutingError, UnknownAction render :file => "#{RAILS_ROOT}/public/404.html", :status => 404 else logger.error

I would like to update the class of all <a> tags found in a div of my page.. I can get it all (seeing the index and value) using : page.select("#header_domain_map a").each do |value, index| page << ''alert(value);'' end but how can I set the classof all these elements to class="active" tfyl kad -- Posted via http://www.ruby-forum.com/.

my where :condition string line is too long in my editor, (Textmate...) if I do a LR, I got a \n in my string, how can i get it displayed in multilines without this garbage in the string : here is the kind of string I am manipulating cond_a.append ["(bookings.start_at == ? OR bookings.end_at == ? ) OR (bookings.start_at <= ? AND bookings.end_at >= ? )",

I am using Action Mailer as stated in RoR book... the mail seems to be correctly setup.. and I get the following log.. Sent mail: Date: Wed, 9 Aug 2006 19:54:04 +0200 From: support@alemat.com To: myself@mac.com Subject: Your password is ... Mime-Version: 1.0 Content-Type: text/html; charset=utf-8 _____________ Your username is barbare. Your new password is tDRvfzNvDF. Please login and change

I have presently a render :json which modify the current page if @request.save format.html { redirect_to(@request) } format.json { render :json => { :result => ''success'', :request => request_path(@request) } } .... but I would like rather to redirect to an index page I wrote this but it doesn''t redirect ... format.json {

I am trying to convert my codeand to use the new Rails 2.0 feature RequestForgeryProtection but I get an InvalidAuthenticityToken error, right from the beginning with my login form.. I followed the recommandations : in my environment.rb config.action_controller.session = { :session_key => ''myappname'', :secret =>

How should I define the :onsuccess option in my - link_to_remote - tag, to execute a Js function I wrote : :success => "toggleButton(this, /db_bfilter/i);" ''this'' is the current element defined in my view : <span id="db_bfilter0" class="depressed"><%= filter_link_helper "This week" %></span> <span

[RAILS3] I hesitate on how handling the locale view templates to default to one language only .. sending admin emails will go only to one locale ''en_GB'' should I set it up into the template name and set I18n.locale to ''en_GB'' membership_renew.en_GB.html.erb OR whatever locale is used , if I have : membership_renew.html it will be the default ? --