不顯示公開訊息中登錄的用戶 - 的Rails

Question

我使用this application，我有唯一的問題是，當用戶登錄時，他們可以看到的公開信息，即使他們沒有創造它。

有沒有辦法把它，所以它不會與其他用戶的信息一起顯示出來？

應用的要點是這樣用戶就可以登錄並撰寫文章，這些都是在默認情況下只意味着私人，他們可以看到它，如果用戶進行了公開發布，我想它所以未記錄在或登錄用戶可以查看，但是，這正是我得到的，但所有的公共帖子與其他用戶的帖子出現。

這裏是應用控制器：

class ApplicationController < ActionController::Base 
    protect_from_forgery 
    rescue_from ActiveRecord::RecordNotFound, :with => :handle_not_found 

    def handle_not_found 
     respond_to do |type| 
     type.html { redirect_to root_path, :notice => 'Record not found'} 
     type.all { render :nothing => true, :status => 404 } 
     end 
     true 
    end 
end 

這裏是柱控制器：

class PostsController < ApplicationController 

    before_filter :authenticate_user!, :except => [:index, :show] 

    # GET /posts 
    # GET /posts.json 
    def index 
    @posts = current_user ? Post.public_or_owned_by(current_user) : nil 
    render :template => current_user ? 'posts/index_logged_in' : 'posts/index_not_logged_in' 
    end 

    # GET /posts/1 
    # GET /posts/1.json 
    def show 
    @post = current_user ? Post.public_or_owned_by(current_user).find_by_url_id!(params[:id]) : Post.public.find_by_url_id!(params[:id]) 

    respond_to do |format| 
     format.html # show.html.erb 
     format.json { render json: @post } 
    end 
    end 

    # GET /posts/new 
    # GET /posts/new.json 
    def new 
    @post = Post.new 

    respond_to do |format| 
     format.html # new.html.erb 
     format.json { render json: @post } 
    end 
    end 

    # GET /posts/1/edit 
    def edit 
    @post = current_user.posts.find_by_url_id(params[:id]) 
    end 

    # POST /posts 
    # POST /posts.json 
    def create 
    @post = current_user.posts.build(params[:post]) 

    respond_to do |format| 
     if @post.save 
     format.html { redirect_to @post, notice: 'Post was successfully created.' } 
     format.json { render json: @post, status: :created, location: @post } 
     else 
     format.html { render action: "new" } 
     format.json { render json: @post.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # PUT /posts/1 
    # PUT /posts/1.json 
    def update 
    @post = current_user.posts.find_by_url_id(params[:id]) 

    respond_to do |format| 
     if @post.update_attributes(params[:post]) 
     format.html { redirect_to @post, notice: 'Post was successfully updated.' } 
     format.json { head :no_content } 
     else 
     format.html { render action: "edit" } 
     format.json { render json: @post.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # DELETE /posts/1 
    # DELETE /posts/1.json 
    def destroy 
    @post = current_user.posts.find_by_url_id(params[:id]) 
    @post.destroy 

    respond_to do |format| 
     format.html { redirect_to posts_url } 
     format.json { head :no_content } 
    end 
    end 
end 

這裏是樁模型：

class Post < ActiveRecord::Base 
    belongs_to :user 
    before_create :generate_url_id 

    attr_accessible :title, :body, :is_public 

    scope :public, where(:is_public => true) 

    def self.public_or_owned_by(user) 
    t = Post.arel_table 
    Post.where(t[:user_id].eq(user.id).or(t[:is_public].matches(true))) 
    end 

    def generate_url_id 
    self.url_id = SecureRandom.urlsafe_base64 
    end 

    def to_param 
    self.url_id 
    end 

end 

這裏是用戶模型：

class User < ActiveRecord::Base 
    # Include default devise modules. Others available are: 
    # :token_authenticatable, :confirmable, 
    # :lockable, :timeoutable and :omniauthable 
    devise :database_authenticatable, :registerable, 
     :recoverable, :rememberable, :trackable, :validatable 

    # Setup accessible (or protected) attributes for your model 
    attr_accessible :email, :password, :password_confirmation, :remember_me 
    # attr_accessible :title, :body 
    has_many :posts 
end 

Answer 1

仍然不知道我理解以及你想要什麼，但我會用兩種不同的路線：

resources :posts  # see all public posts from everyone 
resources :users do 
    resources :posts # nested route for a user to only see his own posts 
end 

所以在你的控制器，你必須：

def index 
    if params[:user_id] 
    if current_user && current_user.id == params[:user_id].to_i 
     # see all posts for a user, even non-public ones 
     @posts = Post.where(user_id: params[:user_id]) 
    else 
     # see public posts from a user 
     @posts = Post.public.where(user_id: params[:user_id]) 
    end 
    else 
    # see all public posts 
    @posts = Post.public 
    end 
end 

這不是最好你可以做，但它是功能性的。更好的方法是使用CanCan等授權機制。