如何只允许帖子的作者编辑或在Ruby on Rails中删除它？

Question

I have a user model and a question model.

In the user model:

has_many :questions

The question model:

belongs_to 

in my questions/show.html.erb

<% if @question.user == current_user %>
  <%= link_to 'Edit', edit_question_path(@question) %> | <%= link_to 'Destroy', @question, method: :delete, data: { confirm: 'Are you sure you want to delete this job?' } %>
  <%= link_to 'Back', questions_path %>
<% else %>
  <%= link_to 'Back', questions_path %>
<% end %>

How can only the user that authored the question edit and delete it?

Answer 1

Take a look at CanCan , the authorization gem by Ryan Bates of Railscasts . It's great for Rails authorization needs.

First, you'll create an Ability class that defines all of the abilities in the application.

class Ability
  include CanCan::Ability

  def initialize(user)
    can :manage, Question, user_id: user.id
  end
end

Then, you'll be able to easily integrate authorization into your controllers.

class QuestionsController < ApplicationController
  def update
    authorize! :manage, @question
    ...
  end
  def destroy
    authorize! :manage, @question
    ...
  end
end

And also customize your views.

<% if can? :manage, @question %>
  <%= link_to 'Edit', edit_question_path(@question) %> | <%= link_to 'Destroy', @question, method: :delete, data: { confirm: 'Are you sure you want to delete this job?' } %>
<% end %>

Answer 2

All you need in your controller is:

def destroy
  @question = current_user.questions.find(params[:id])
  @question.destroy

  render ... #anything you want to render
end

The previous code will ensure that an user can only delete his own questions. If the id of the question doesn't belongs to the user no question will be deleted and it would throw and ActiveRecord::RecordNotFound - Internal Server error . You can add a begin - rsecue block to catch this exception an handle it as you want.

def destroy
  begin
   @question = current_user.questions.find(params[:id])
   @question.destroy
   render or redirect_to ....
  rescue Exception ActiveRecord::RecordNotFound
   flash[:notice] = 'not allow to delete this question'
   redirect_to ....
  end
end

Other simple way is to add a before filter in your controller

before_filter :require_authorization, only: [:delete]
...
def destroy
   @question = current_user.questions.find(params[:id])
   @question.destroy
   render or redirect_to ....
   #With the before filter this code is only going to be executed if the question belongs to the user
end
...
private
def require_authorization
  redirect_to :root unless current_user.questions.find_by_question_id(params[:id])
  #Use the find_by to avoid the ActiveRecord::RecordNotFound and get a nil instead in case the question id doesn't belong to a question of the user
end

Answer 3

you can try changing your if to the following:

<% if current_user.questions.include?(@question) %>

Also you can take a look at :inverse_of

Then in your Edit and Delete actions in the controller you can again check for the right user before showing the edit form or deleting the question.