如何确保用户只能删除自己的评论？ 轨道

Question

I have comments underneath a bunch of questions, right now the code I have shows the delete comment link under everyone's comments not just the user who made the comment. How do I fix this so that users can only delete comments they made themselves? I am using devise gem to authenticate users.

<% commentable.comments.each do |comment| %>
  <h6 style="text-align:left; margin-bottom: 0px;"><strong><%= comment.user.profile.first_name %> <%= comment.user.profile.last_name %>: </strong></h6>
<p style="text-align:left">
  <%= comment.body %>
</p>
  <% if current_user %>
    <p style="text-align:left; font-size: 12px; margin-top: -10px"><%= link_to 'Delete', [comment.user, comment],
                 method: :delete,
                 data: { confirm: 'Are you sure?' } %></p>
  <% end %>
<% end %>

comments_controller.rb

class CommentsController < ApplicationController
  before_action :authenticate_user!

  def create
    @comment = @commentable.comments.new(comment_params)
    @comment.user = current_user
    if @comment.save
      redirect_back(fallback_location: root_path)
    end
  end

  def update
    @comment.update(comment_params)
  end

  def destroy
    @comment = Comment.find(params[:id])
    @comment.destroy
    redirect_back(fallback_location: root_path)
  end

  private

    def comment_params
      params.require(:comment).permit(:body)
    end
end

comment.rb

class Comment < ApplicationRecord
  belongs_to :commentable, polymorphic: true
  belongs_to :user
end

user.rb

class User < ApplicationRecord
  before_create :add_role_to_user
  ROLES = %w[admin member].freeze

  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable
  has_one :profile
  has_many :comments, dependent: :destroy

  def add_role_to_user
    self.role = 'member'
  end

end

Answer 1

Change your view:

<% if current_user && current_user == comment.user %>

Change your controller:

def destroy
  # ensure user only can find owner comment.
  @comment = current_user.comments.find(params[:id])
  @comment.destroy
  redirect_back(fallback_location: root_path)
end

Answer 2

If you change <% if current_user %> in your view to <% if current_user && current_user == comment.user %> then the Delete link will only appear for the owner of that comment.

You should also check that the current_user matches the @comment.user in your destroy controller method.