借助rails before_action，您如何防止恶意用户创建，更新，编辑和删除

Question

The rails before action seems useful for setting a variable shared by a number of actions in a controller.

But isn't the default implementation of the set_post that we see commonly on tutorials etc open to an attack by a malicious user?

If we take a controller like this:

PostsController < Application Controller
  before_action :set_post , only: [:show,:create,:update]

  def show
  ...
  end

  def create
  ...
  end

  def update
  ...
  end

  private
  def set_post
    @post = Post.find(params[:id])
  end
end

When a user is presented the opportunity to update a post for example the form would be generated for them, and on post, params[:id] would contain the ID of the appropiate post - probably owned by the current_user.

However, it would not be difficult for a malicious user to alter the posted :id variable to allow them to actually end up setting the @post variable in the controller, to represent a different post, rather than the original being updated.

I could see this being safer:

private
def set_post
  @post = Post.find(params[:id])
  if(@post.user_id != current_user.id)
   redirect_to homepage, alert: "you can edit your own posts"
  end
end

However - that would stop other users viewing other people's posts! So how and where should this kind of check be performed to ensure that only the owner of a particular post can update / edit it. Is that something for the update controller action to handle itself with a check like this :

def update
  if @post.user_id != current_user.id
    redirect_to homepage, alert: "you can edit your own posts"
  end
  ...
end

Answer 1

You are right, and I actually see that security issue being made very often by newbie Rails programmers. They just generate scaffolds and don't change things to their needs.

I'm using something like the following in my controllers:

before_action :set_post
before_action :check_post_ownership, except: :show

private

def set_post
  @post = Post.find(params[:id])
end

def check_post_ownership
  redirect_to homepage, alert: "..." unless @post.user_id == current_user.id
end