停止发布到外部服务以查找用户ID

Question

I'm not really sure how to describe this issue so will try to be clear.

We have a page in our Rails application where our customers can update their credit card details. The form posts to an external service to verify the details. Then redirects back to us transparently.

Initially I had the form in it's own controller for testing (working perfectly) but I've just moved it within my users_controller.

The form posts and redirects to a confirm action which does some checks. When I post from within the users controller, I get an error:

 Couldn't find User with id=k2hx5p36w3g9rxsz

Which in fact is the id of the transaction. Not the user.

The url looks like this:

 http://localhost:8080/settings/confirm?http_status=200&id=k2hx5p36w3g9rxsz&kind=update_payment_method&hash=9c85b12c1242cd58de27b2582c934e34a0e9455e6

In my controller, I have this:

def billing
  @user = current_user 
  @credit_card = current_user.default_credit_card  
  @tr_data = CreditCard::TransparentRedirect.update_credit_card_data(:redirect_url => confirm_credit_card_info_url, :payment_method_token => @credit_card.token)
  ...
end

def credit_card_confirm
  @user = current_user 
  @result = CreditCard::TransparentRedirect.confirm(request.query_string)

  if @result.success?
    redirect_to user_billing_path, :notice => "Credit card updated"
  else
    render :action => "billing"
  end
end

And in my routes:

match '/settings/confirm' => 'users#credit_card_confirm', :as => :confirm_credit_card_info

What can I do to avoid it taking the ID as the User ID?

Answer 1

You probably have something like a before_filter or cancan which takes the id from params and tries to load the corresponding object. This is a common practice in controllers.

The point is that params contains a merge of:

• the named params that are set from the router ( /users/:id )
• the query string, as converted by http://apidock.com/rails/Rack/Utils/parse_nested_query
• the body if present, as above or converted from JSON/XML as needed.

So GET /users/1 and GET /users?id=1 have the same effect.

The solution is to understand in which specific piece of your code the id is used to load a User. If it is your code (or otherwise skippable), then skip the filter or whatever appropriate for the credit_card_confirm action, if it is not your code, you have to use a separate controller.