El Thursday 02 October 2008 09:32:34 Sergio Cambra .:: entreCables - Symbol
Servicios Informáticos S.L. ::. escribió:
> El Wednesday 01 October 2008 23:22:56 WW escribió:
> > After looking through, in detail, of the security layer in AS, I just
> > want to make sure that I have the right understanding.
> >
> > It seems to me that #{action_name}_authorized? methods in your
> > controller will remove the links from AS unless you are authorized to
> > see it. However, it does not prevent an user from initiating that
> > action.
> >
> > For example, if I have an action link named backup_data, this action /
> > method will have to be public to be accessible by an action url. I
> > can create a backup_data_authorized? method in the controller, and
> > this will hide / show the action link to the proper authorized user.
> > However, I can manually access that action through the URL
> > http://ruby/controller/backup_data and it will actually run the
> > action.
> >
> > Therefore, my conclusion is that the security layer at the controller
> > level for AS prevents the users from seeing the actions links, but to
> > really secure the action, you will need additional layer to protect
> > the action from being executed.
> >
> > Can someone confirm this? Or am I using AS security incorrectly?
> >
> > Thank you.
>
> I think it's a bug in AS, because #{action_name}_authorized? are added as
> before_filter, but a before_filter needs redirect or render something to
> prevent an action, and you can't redirect or render in methods used in a
> view.
I have thought about this, you can render o redirect only when action is not
performed and it should work to halt the request and hide the links:
def #{action_name}_authorized?
if <condition>
true
else
render :nothing => true, :status => 403 unless performed?
false
end
end
--
Sergio Cambra .:: entreCables - Symbol Servicios Informáticos S.L. ::.
Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza
T) 902 021 404 F) 976 52 98 07 E) [EMAIL PROTECTED]
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
