設計不控制確切的編輯用戶的編號

Question

我在軌應用程序中安裝設計。如果用戶登錄，他可以訪問所有其他用戶編輯頁面。

例如，我是user_id 2，我可以編輯用戶的配置文件1/3/4/5 .....當我在路線中手動修改參數。

這裏我的應用程序控制器：

class ApplicationController < ActionController::Base 
    protect_from_forgery 
    before_action :authenticate_user! 

    before_action :configure_permitted_parameters, if: :devise_controller? 

    def configure_permitted_parameters 
    # For additional fields in app/views/devise/registrations/new.html.erb 
    devise_parameter_sanitizer.permit(:sign_up, keys: [:first_name, :last_name, :company, :position, :office_phone, :mobile_phone, :address, :description, :radius, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []]) 

    # For additional in app/views/devise/registrations/edit.html.erb 
    devise_parameter_sanitizer.permit(:account_update, keys: [:first_name, :last_name, :company, :position, :office_phone, :mobile_phone, :address, :description, :radius, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []]) 
    end 
end 

這裏我的用戶控制器：

class UsersController < ApplicationController 

    skip_before_action :authenticate_user!, only: [:index, :show] 
    before_action :set_user, only: [:show, :edit, :update] 

    def index 
    @client = Client.new 

    @users = User.all 
    @users = User.where.not(latitude: nil, longitude: nil) 

    @hash = Gmaps4rails.build_markers(@users) do |user, marker| 
     marker.lat user.latitude 
     marker.lng user.longitude 
    end 

    end 

    def show 
    @client = Client.new 
    @user = User.find(params[:id]) 
    end 

    def new 
    @user = User.new 
    end 

    def create 
    @user = User.new(user_params) 
    @user.save 

    redirect_to users_path 
    end 


    def edit 
    @user = User.find(params[:id]) 
    end 

    def update 
    @user = User.find(params[:id]) 
    @user.update(user_params) 

    redirect_to user_path(@user) 
    end 


    private 

    def user_params 
    params.require(:user).permit(:company, :first_name, :last_name, :position, :mobile_phone, :office_phone, :email, :address, :description, :radius, :nettoyage_toiture, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []) 
    end 

    def set_user 
    @user = User.find(params[:id]) 
    end 

end 

這裏畝用戶模式：

class User < ApplicationRecord 
    has_attachment :photo_presentation 
    has_attachment :photo_company_logo 
    has_many :projects, dependent: :nullify 
    # Include default devise modules. Others available are: 
    # :confirmable, :lockable, :timeoutable and :omniauthable 
    devise :database_authenticatable, :registerable, 
    :recoverable, :rememberable, :trackable, :validatable 
    #geocoder for google maps 
    geocoded_by :address 
    after_validation :geocode, if: :address_changed? 
end 

這裏我的路線：

Rails.application.routes.draw do 
    ActiveAdmin.routes(self) 
    devise_for :users 
    root to: 'pages#home' 
    resources :users do 
    resources :projects 
    end 
    resources :clients, only: [:new, :create, :show] 
    mount Attachinary::Engine => "/attachinary" 
    # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html 
end 

非常感謝！

Answer 1

Devise是一個認證庫。您有授權問題。所以，你應該使用一些授權。我使用CanCan。有了它，你可以定義的權限是這樣的：

can :edit, User, id: current_user.id 

如果你不想學習另一個庫，你總是可以做貧民區授權在控制器中。

class UsersController 
    before_action :can_edit_only_self, only: [:edit, :update, :destroy] 

    private 

    def can_edit_only_self 
    redirect_to root_path unless params[:id] == current_user.id 
    end 
end 

---

_{*認證 - 我知道你是誰}

_{*授權 - 我知道你被允許這樣做}

Answer 2

問題是這樣的：

def edit 
    @user = User.find(params[:id]) 
end 

def update 
    @user = User.find(params[:id]) 
    @user.update(user_params) 

    redirect_to user_path(@user) 
end 

如果你不希望用戶能夠編輯其他用戶，那麼你不需要這兩種方法。你也可以改變你的路線文件：

resources :users, except: [:edit, :update] do 
    resources :projects 
end 

更新

如果您以前的編輯，並在終端類型rake routes，你應該看到，設計爲編輯用戶的控制器操作。它應該是users/edit沒有:id參數。在Devise :: RegistrationsController中，編輯方法應該只使用current_user輔助方法來編輯當前登錄用戶的帳戶信息。

如果你想admin用戶能夠編輯其他用戶，那麼你要了解以下寶石

1. Can Can
2. Pundit

有了這些寶石之一您可以定義哪些用戶「角色」可以根據其角色編輯其他用戶。您還可以使用這些寶石來授予創建，讀取，更新，刪除其他資源的權限。