允许用户仅在 ruby​​ on rails 上编辑某些信息，而不能在管理员上编辑

Question

I'm working on a rails app that i want to allow users to edit only some of their information, like name or personal information, but i want the admin user to be able to edit every thing. is there any one to help me with this?

Answer 1

thanks to @tadman this is what i came up with

def user_params_UserEdit
  if current_user?(@user)
  params.require(:user).permit( :password,
                               :password_confirmation)
elsif current_user.admin?
    params.require(:user).permit(:name, :email, :password,
                               :password_confirmation, :admin, :personel_number)
  end
end

and for update :

def update
@user = User.find(params[:id])
if @user.update_attributes(user_params_UserEdit)
  flash[:success] = "Profile updated"
  redirect_to root_url
else
  render 'edit'
end
end

it works fine with me what do you think?

Answer 2

You can use cancan feature for this purpose. It's clean and provides many features to add/modify the permissions.

Have a look
https://github.com/ryanb/cancan

Also there is a tutorial on how to use it
http://railscasts.com/episodes/192-authorization-with-cancan