similar to: REST routes :has_many , new style

what''s the best protection against someone trying to modify an URL in a named route /users/25/posts if the user enter another URL /users/26/posts, he can get acces to user 26 posts unless .. a before_filter is checking the current_user ID but is there any other way to do it ? thanks for your lights kad -- Posted via http://www.ruby-forum.com/.

If I use http://0.0.0.0:3000/users/25/messages/new I can create a new message ressource for user 25 that''s OK.... I would like to be able to use such url : http://0.0.0.0:3000/users/25/messages;send?to=5 in order to create a new message from user 25 for a specific receiver how should write my route ? I tried.... map.resources :users do |users| users.resources :messages,

I can sent my own action to a users_controller stating in routes.rb map.resources :users, :member => { :network => get } I defined in my users_controller the network action.... so I can have an url like "http://localhost:3000/users/168.xml;network" now I would like to have another action network_plus which is a little bit different fron the network.. sure, I can state another

in my booking / _form I have the following input fields : (startdate and endate) <div> <label for="startdate">Booking Start Date</label><br /> <%= text_field_tag(''startdate'', @startdate, {:class => @startdateclass, :readonly => "readonly", :maxlength => "25"} ) %> <%= observe_field("startdate",

I am trying to use the new Rails 2.0 macro : rescue_from class PostsController < ApplicationController rescue_from ActiveRecord::RecordNotFound, :with => :deny_access ... def show @post = Post.find_by_id(params[:id]) raise ActiveRecord::RecordNotFound if @post.nil? #illegal access ..... end def deny_access respond_to do |format| format.html end end but the

I read the following tag in teh Beast example <%= submit_tag''Login'', :or => link_to_function(''forgotten password'', "$(''reset-password'').toggle();") %> I understand the link_to_function, but what is this :or parameter used for ? the link doesn''t appear, so it cannot be used... thanks for your lights kad --

In a panel, I have an hidden input field which is modified by a javascript function (from calendar) how can I sent the value of this input field in my link_to_remote call ? presently I just send back one parameter (an id) but I need both... <input type="hidden" name="booking[start_at]" id="f_date_s" value="booking[start_at]" /> ... <%=

OS X 10.4.8 I am sending an email via Actionmailer settings are written correctly in environment.rb ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.raise_delivery_errors = :true ActionMailer::Base.perform_deliveries = :true ActionMailer::Base.default_charset = "utf-8" ActionMailer::Base.server_settings = { :address => "mail.mydomain.com", :port => 25,

I am using Action Mailer as stated in RoR book... the mail seems to be correctly setup.. and I get the following log.. Sent mail: Date: Wed, 9 Aug 2006 19:54:04 +0200 From: support@alemat.com To: myself@mac.com Subject: Your password is ... Mime-Version: 1.0 Content-Type: text/html; charset=utf-8 _____________ Your username is barbare. Your new password is tDRvfzNvDF. Please login and change

I tried to use named parameters in my SQL query , using find_by_sql Order.find_by_sql ([select * from orders where amount > ? and quantity > ?", [ @amount, @quantity ] works;.. but Order.find_by_sql ([select * from orders where amount > :amount and quantity > :quantity ", [ :amount => @amt, :quantity => @qty ] is not working a I wrong or should I use a plain select

I have presently a render :json which modify the current page if @request.save format.html { redirect_to(@request) } format.json { render :json => { :result => ''success'', :request => request_path(@request) } } .... but I would like rather to redirect to an index page I wrote this but it doesn''t redirect ... format.json {

I am trying to convert my codeand to use the new Rails 2.0 feature RequestForgeryProtection but I get an InvalidAuthenticityToken error, right from the beginning with my login form.. I followed the recommandations : in my environment.rb config.action_controller.session = { :session_key => ''myappname'', :secret =>

How should I define the :onsuccess option in my - link_to_remote - tag, to execute a Js function I wrote : :success => "toggleButton(this, /db_bfilter/i);" ''this'' is the current element defined in my view : <span id="db_bfilter0" class="depressed"><%= filter_link_helper "This week" %></span> <span

[RAILS3] I hesitate on how handling the locale view templates to default to one language only .. sending admin emails will go only to one locale ''en_GB'' should I set it up into the template name and set I18n.locale to ''en_GB'' membership_renew.en_GB.html.erb OR whatever locale is used , if I have : membership_renew.html it will be the default ? --

In the console to check my paths, I used to write ( In Rails 2) include ActionController::UrlWriter then I could test my paths : new_project_path , .... but now in Rails 3 include ActionController::UrlWriter gives an error NameError: uninitialized constant ActionController::UrlWriter sure something changed, any other additional include needed ? thanks fyh -- You received this message

HI I don''t understand what happen .. if I use the script/console : >> include ActionView::Helpers::DateHelper => Object >> include GLoc => Object >> time_ago_in_words(Time.now, include_seconds = false) => "moins d''une minute" I get the correct answer.. but I I write in my view <%= time_ago_in_words(Time.now, include_seconds = false)

In one of my view , I have an image the user need to click to close a <div>selections</div> added by an Ajax call. if I use : <img src ="/images/icon_closeitem.gif", size="16*16", border="0",alt="Close Selection", title="Close", onclick="<%= remote_function(:url => { :controller => ''property'',

Hello I am trying to transform my web app into a 2.2 ready app, in my config/environment.rb I wrote Rails::Initializer.run do |config| ..... # disabling the surrounding div if validation error ActionView::Base.field_error_proc = Proc.new do |html_tag, instance| if html_tag.include?("class=") html_tag.sub(%r{(class=["''])}, ''\1invalid '')

I easily implemented the upload , using the ''attachment_fu'' plugin... I can see and open the uploaded files (a pdf file 60k and a jpeg images 28k) now I try to implement the download action in my document_controller, I wrote : def download @document = Document.find(params[:id]) send_file(@document.full_filename, :filename =>

I have an ''account_controller.rb'' in an ''admin'' module I list the accounts with : http://0.0.0.0:3000/admin/accounts/list, and get my table trying to sort it, I use the follwoing sort_link_helper : def sort_link_helper(text, param) key = param key += "_reverse" if @params[:sort] == param options = { :url =>