[Rails] Re: rails security help

2009-10-22 Thread Marli Ba
Gaspard, I noticed your program uses scopes to limit the returned information. I'm running rails 2.3.4 and there seems to be an issue with scopes and HABTM relationships: that they don't carry through. I've tried using named scopes in my Product class like this: class Product < ActiveRecord::

[Rails] Re: rails security help

2009-10-15 Thread Marli Ba
Gaspard Bucher wrote: > > We use something similar to filter objects in zena > (http://bit.ly/2yjaVk). Basically, you need two things: > > 1. the visitor pattern (stored in Thread.current) > 2. scoped finders > > I wrote an exemple of what you could use to filter fields: > http://gist.github.

[Rails] Re: rails security help

2009-10-14 Thread Gaspard Bucher
Marli Ba wrote: > Hey I was wondering if anyone knows of a gem or plugin that can limit > fields returned based on the User's role? I'm looking for something > that will basically rewrite the find() method to limit the fields > returned based on the User role. > > so, > > Admin: > Product.all =