I have a number of models: users, households, bills. They are hierarchically related in the sense that a 'user' has many 'households' and a 'household' has many 'bills'. I have enabled active scaffold on each of the three controllers: users_controller, households_controller and bills_controller.
I want users to be able to modify only their own records, for any of the models. So - in the users_controller, i've used 'conditions_for_collection' to ensure that when a user navigates to the url: /foo_app/users, they see only themselves listed. From their own user row, they can access the nested models households and bills, in each case, seeing only those records that are descendants of themselves (not of other users). The problem I have si that there's a huge security hole: if a user navigates to the url: /foo_app/bills, they can see all the bills for all the users and for all the households. What's the simplest way to preclude this? I've been struggling with it for a while. I can create 'conditions_for_collection' methods for the households model and the bills model (in addition to the one that i've created for the users model), but this quickly gets unwieldy (both because I actually have more than just two descendant models and because it's non trivial to get the conditions for association when there are multiple levels of hierarchy between the model of interest and the user model). Anything that I do to try to restrict access to the controller at a higher level, has the result of restricting access even when I come to the controller through the proper routs (user->household->bill). Is there some way to tell AS that it should only allow access to a model through its parent (or its parent's parent and so on), as opposed to directly? Yoram --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
