如何在Devise（Ruby on Rails）中阻止url地址

Question

I blocked display links on the show page:

<% if @post.user == current_user %>
  links
<%end%>

but I can't block url adress for unprivileged users:

http://localhost:3000/posts/1/edit

What can I do?

Answer 1

It's good possibility to use Pundit gem ( https://github.com/elabs/pundit ). Your policy will look:

class PostPolicy
  attr_reader :user, :post

  def initialize(user, post)
    @user = user
    @post = post
  end

  def edit?
    post.user == user
  end
end

And your controller's action:

def edit
    @post = Post.find_by(id: params[:id])
    authorize @post
    ...
end

Answer 2

Within the edit action on your controller, perform the same check - something like:

@post = Post.find_by( id: params[:id] )

unless @post.user == current_user
  fail(ActionController::RoutingError, 'User cannot edit this post.')
end

You can simplify the error check into:

fail(ActionController::RoutingError, 'User cannot edit this post.') unless @post.user == current_user

I hope this helps!

Answer 3

I guess the best way to do this is to use before_filter in your posts controller, ie:

before_action :authorize_admin, only: [:show, :edit, :update, :destroy]

or:

before_filter :authorize_admin, except: [:show]

where :authorize_admin is the method that You have to define either in posts controller (to use for posts only) or in application controller (to use in all controllers), like this:

  def authorize_admin
    redirect_to :new_user_session unless current_user&&current_user.admin?
  end

Answer 4

What you're looking for is something called authorization

Authentication = finding out if a user is present

Authorization = determining if they are able to perform specific requests

The answer by Sergei Stralenia is correct - you'll need to use one of the authorization gems -- Pundit and CanCanCan being two of the most popular -- to validate whether a user is able to edit a particular object.

In regard the routing, you'll not be able to remove the edit route, unless you separate it out into something like an admin namespace (I'll explain more in a second).

--

Sergei Stralenia 's post showed you how to use Pundit , I'll show you CanCanCan :

#app/models/ability.rb
class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user (not logged in)
    if user.admin?
      can :manage, Post
    else
      can :read, Post
    end
  end
end

#app/controllers/posts_controller.rb
class PostsController < ApplicationController
   def edit
     @article = Post.find params[:id]
     authorize! :edit, @article
   end
end

---

Admin

If you wanted to make a post only editable in an "admin" area, you'd be best using something like the following:

#config/routes.rb
resources :posts, only: [:index, :show]
namespace :admin do
   resources :posts, only: [:new, :create, :edit, :update, :destroy]
end

This way, you will literally have no way for a non-admin user to edit/update posts in the front-end. Instead, they'll have to go into the admin area and make it so that they are able to edit it in there...

#app/controllers/admin/posts_controller.rb
class Admin::PostsController < ApplicationController
   #actions & authorization in here
end