actual code w Logger instrumentation:
def authorized_for_update?
SCLOG.info(current_user.inspect)
SCLOG.info(self.inspect)
if (current_user.role == 'admin')
return true
else
return (self.user_id == current_user.id)
end
end
Log output:
#<User id: 46, login: "test", role: "user", email: "test",
crypted_password: "xxx", salt: "xxx", created_at: "2009-02-26
08:54:38", updated_at: "2009-02-26 11:58:49", remember_token: nil,
remember_token_expires_at: nil, activation_code: nil, activated_at:
"2009-02-26 16:54:45", state: "active", deleted_at: nil, first_name:
"test", last_name: "test", address: "address", city: "city", zip: 0,
home_phone: nil, cell_phone: nil, work_phone: nil, drivers_license:
nil, license_expiration: nil, car1_id: nil, car2_id: nil, spouse_id:
nil>
#<Student id: nil, created_at: nil, updated_at: nil, first_name: nil,
last_name: nil, address: nil, city: nil, zip: nil, email: nil,
home_phone: nil, cell_phone: nil, klass_id: nil, user_id: nil>
Which means that the self object is not set but we happen to know that
it is of the correct type.
Is there a bug here in AS ?
/S
On Feb 26, 11:18 am, rbarton <[email protected]> wrote:
> Personally, I would add a logger.info 'got here' line to the top of
> the method, then add another logger.info with details on the two
> variables you're comparing after the 'else' to see what's going on...
>
> One other thing--you should probably check to make sure that
> current_user exists before using it. See the API...
>
> Ryan
>
> On Feb 26, 2:04 pm, Soren <[email protected]> wrote:
>
> > Sorry - very much a sleep here
>
> > The entry has to go to the model not to the controller. And then the
> > name has to be right too - guess I need some more coffee.
> > Here is an entry that mostly works for me:
>
> > in model:
>
> > protected
>
> > def authorized_for_update?
> > if (current_user.role == 'admin')
> > return true
> > else
> > return (self.user_id == current_user.id)
> > end
> > end
>
> > BUT - how come the comparison of user_id's does not work ? Did I goof
> > again ?
>
> > /S
>
> > On Feb 26, 10:33 am, Soren <[email protected]> wrote:
>
> > > Like Ben I have the same issue. Depending on the data on a particular
> > > line in the list view I need to enable/disable some of the links.
>
> > > I can define the following in the corresponding controller:
> > > protected
>
> > > def update_authorized?
> > > return false unless current_user.role == 'admin'
> > > end
>
> > > def delete_authorized?
> > > return false unless current_user.role == 'admin'
> > > end
>
> > > This does not take into account the particular record, so how do we
> > > get access to that record.
>
> > > The wiki shows an example but it does not show how to get access to
> > > the details of each record.
> > > I tried something like
>
> > > def update_authorized?
> > > return (self.user_id == current_user.id)
> > > return false unless current_user.role == 'admin'
> > > end
>
> > > But as far as I get it the self is not the record.
> > > So what structure do I need to check in order to get access to the
> > > current record ?
>
> > > /S
>
> > > On Feb 26, 9:15 am, Benjamín Cárdenas Salamandra <[email protected]>
> > > wrote:
>
> > > > hola,
> > > > yes is enough with enable/disable action, thanks, and i don't now over
> > > > this implementation, just two months ago i needed it and i read all AS
> > > > documentation and not see that, and not take time to hack this
> > > > functionality (sorry if i say some incorrect, my english writing is
> > > > very bad),
> > > > Benjamín
> > > > rbarton escribió:Closer, Benjamin, You can apply model-based
> > > > authorization to enable/disable action links on a per-record basis, see
> > > > the very bottom of that security wiki page for an example. Now if
> > > > disabling is not good enough, you want the entire link text to
> > > > disappear, you'll have to override the _list_actions partial for that
> > > > controller, and filtering out the link rendering part explicitly. Start
> > > > by copying the default one out of the AS directory structure
> > > > (active_scaffold/frontends/default/views/_list_actions.rhtml) and
> > > > putting it in your controller directory, then edit and test as needed.
> > > > Ryan On Feb 25, 3:49 pm, Benjamín Cárdenas
> > > > Salamandra<[email protected]>wrote:Hola, I need the same
> > > > functionality too, is better try to implement in the edge, no? Benjamín
> > > > Closer escribió:Hi,I want to hide some action links (see
> > > > attachmenthttp://download.maksd.ru/hide_some_actions.png). How can I do
> > > > it?Thanks, Maxim Dobriakov
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"ActiveScaffold : Ruby on Rails plugin" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/activescaffold?hl=en
-~----------~----~----~----~------~----~------~--~---
