CODEWITHSUNDEEP
ruby-on-railsruby
roram
roram

Reputation: 37

Only allow logged in/current users to edit their own post

I have a table of post in which users log into the application and can post an item. Ideally, I would like to have users edit only their post and no one else's. So far, I have it so that users are able to edit posts, but also edit others.

This is what I think I need to get fixed from index.html.erb file: 

<td><%= review.review %> (<% if current_user%><%= link_to 'Edit', edit_review_path(review)%><%end%>)</td>

Upvotes: 2

Views: 271

Answers (1)

Sebasti&#225;n Palma
Sebasti&#225;n Palma

Reputation: 33420

You can use something like:

<% if user_signed_in? && current_user.id == @review.user_id %>

Which is saying, check if the user is already logged, and check if the current_user is the owner of the review, checking the current_user id and the id from the owner of such review.

So you can try:

<td>
  <%= review.review %>
  <% if user_signed_in && current_user.id == review.user_id %>
    <%= link_to 'Edit', edit_review_path(review) %>
  <% end %>
</td>

You can also create a method an use it as before_action to check for the match between the current_user and the owner of the review, but I think the view "validation" could be enough.

Upvotes: 3

Related Questions