CODEWITHSUNDEEP
ruby-on-railsrubyruby-on-rails-3ruby-on-rails-3.1ruby-on-rails-3.2
korywka
korywka

Reputation: 7653

In what controller's action better to check users rights?

In 'new' or 'create'? In 'edit' or 'update'?

I check with this line:

correct_user(@car.user) if not current_user.admin?

where 

def correct_user(user)
   redirect_to root_path if current_user != user
end

Upvotes: 0

Views: 76

Answers (2)

gmalette
gmalette

Reputation: 2459

In every single place a user cannot access if he doesn't have the permissions.

I would structure the code so that you don't have to write it in the action:

before_filter :load_car, :redirect_unless_correct_user!, :except => :index

protected
def load_car
  @car = Car.find(params[:car_id])
end

def redirect_unless_correct_user!
  redirect_to(root_path) unless (current_user == @car.user) || user.admin?
end

Upvotes: 1

xdazz
xdazz

Reputation: 160833

If these actions all need the admin right, you'd better use a before filter.

before_filter :correct_user,  :only => [:new, :create, :edit, :update]

Upvotes: 2

Related Questions