ruby-on-rails - 防止用户浏览隐藏的作者

Question

我有一个索引页，它使用 bool 值隐藏/显示不同的作者。我遇到的问题是登录用户仍然可以通过 URL 访问隐藏的作者及其书籍。

如何防止当前用户通过 URL 导航到隐藏的作者及其对应的书籍？如果作者被隐藏，有没有办法将他们重定向回作者页面？

目前，我已经使用 Controller 和一个 bool 值来帮助隐藏/显示登录用户的作者或书籍。有人可以指出我正确的方向吗？这是我的代码。

模型

class Author < ActiveRecord::Base
  attr_accessible :name, :photo

  has_many :books

end

class Book < ActiveRecord::Base
  attr_accessible :author_id, :title, :photo

  belongs_to :author

end

控制者

class AuthorsController < ApplicationController
  before_filter :signed_in_user, only: [:index]
  before_filter :admin_user, only: [:edit, :update, :destroy, :new, :show]

  respond_to :html, :js

  ###Only displays unhidden authors to non admin users.  

  def index
    if current_user.admin?
      @authors = Author.all(:order => "created_at")
    else
      @authors = Author.where(:display => true).all(:order => "created_at")
    end
  end

  private

    def signed_in_user
      unless signed_in?
        store_location
        redirect_to (root_path), notice: "Please sign in."
      end
    end

    def admin_user
      redirect_to(root_path) unless current_user.admin?
    end
end

class BooksController < ApplicationController
  before_filter :signed_in_user, only: [:index]
  before_filter :admin_user, only: [:edit, :update, :destroy, :new, :show]
  before_filter :get_author

  respond_to :html, :js

  def get_author
    @author = Author.find(params[:author_id])
  end

  def index
    @books = @author.books
  end

  private

    def signed_in_user
      unless signed_in?
        store_location
        redirect_to (root_path), notice: "Please sign in."
      end
    end

    def admin_user
      redirect_to(root_path) unless current_user.admin?
    end
end

观点

Authors index.html.erb

<% @authors.each do |author| %>

  <%= link_to (image_tag author.photo(:medium)), 
    url_for(author_books_path(author)),
    class: "img-rounded" %>

<% end %>

### How Can I prevent Users from accessing Hidden Author's Books (Index Page)
Books index.html.erb

  <% @books.each do |book| %>
    <%= image_tag book.photo(:medium) %>
    <%= book.name %>
  <% end %>

路线

resources :authors do
  resources :books
end

架构

create_table "authors", :force => true do |t|
  t.string   "name"
  t.boolean  "display",             :default => false
  t.datetime "created_at",                             :null => false
  t.datetime "updated_at",                             :null => false
  t.string   "photo_file_name"
  t.string   "photo_content_type"
  t.integer  "photo_file_size"
  t.datetime "photo_updated_at"
end

create_table "books", :force => true do |t|
  t.integer  "author_id"
  t.string   "title"
  t.datetime "created_at",          :null => false
  t.datetime "updated_at",          :null => false
  t.string   "photo_file_name"
  t.string   "photo_content_type"
  t.integer  "photo_file_size"
  t.datetime "photo_updated_at"
end

Answer 1

使用适当的授权模型，例如 CanCan .

关键部分(对于 CanCan)是基于用户角色的授权:

if user.role == admin
  can :manage, :all
else 
  can :read, Author, display: true
end

有帮助 RailsCast引导您使用 CanCan 进行授权。

存在其他选项，例如 Declarative Authorization ，或者您可以自己推出。