CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3ruby-on-rails-3.1ruby-on-rails-3.2
pratski
pratski

Reputation: 1488

Edit Update actions in Rails?

I have been through M. Hartl's book on ROR Tutorial and in there for the Edit and Update action for the user the book uses "@user = User.find(params[:id])" to find the user and then for authorization purposes adds a "correct_user" method which checks if @user is the current user. The thing that is baffling me is that why can't I just find the user to begin with using "@user = current_user" in the edit and update actions so that I don't have to worry about users passing in other User ID's through the URL. Does this approach I am thinking of leave any security loopholes? I am using Devise so I already have a current_user method handy.

Upvotes: 0

Views: 97

Answers (1)

heartpunk
heartpunk

Reputation: 2275

One potential problem with that approach is that it might be a user with special privileges (admin, moderator, etc.) trying to edit another user that they are allowed to update. Best to stick with fetching from the database. Also, if rails has already fetched the user in the current request cycle, the object should be cached, so it shouldn't actually do a second database request anyways.

Upvotes: 1

Related Questions