El Wednesday 01 October 2008 23:22:56 WW escribió:
> After looking through, in detail, of the security layer in AS, I just
> want to make sure that I have the right understanding.
>
> It seems to me that #{action_name}_authorized? methods in your
> controller will remove the links from AS unless you are authorized to
> see it. However, it does not prevent an user from initiating that
> action.
>
> For example, if I have an action link named backup_data, this action /
> method will have to be public to be accessible by an action url. I
> can create a backup_data_authorized? method in the controller, and
> this will hide / show the action link to the proper authorized user.
> However, I can manually access that action through the URL
> http://ruby/controller/backup_data and it will actually run the
> action.
>
> Therefore, my conclusion is that the security layer at the controller
> level for AS prevents the users from seeing the actions links, but to
> really secure the action, you will need additional layer to protect
> the action from being executed.
>
> Can someone confirm this? Or am I using AS security incorrectly?
>
> Thank you.
I think it's a bug in AS, because #{action_name}_authorized? are added as
before_filter, but a before_filter needs redirect or render something to
prevent an action, and you can't redirect or render in methods used in a
view.
--
Sergio Cambra .:: entreCables - Symbol Servicios Informáticos S.L. ::.
Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza
T) 902 021 404 F) 976 52 98 07 E) [EMAIL PROTECTED]
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
