阻止不同的用戶通過show方法查看模型

Question

在我的每種模型的索引方法中，我確保從當前用戶開始查詢：current_user.model.all，以僅顯示屬於當前用戶的模型。

我所有模型的show方法都非常簡單和標準，沒有current_user。

def show 
    @logica = Logica.find params[:id] 
    authorize @logica 
    end 

這確實會打開用戶在URL中輸入隨機ID並從不同用戶看到模型的機會。防止這種情況發生的最好方法是什麼？

Answer 1

的has_many協會有許多不同的方法可用，包括find

current_user.model.find(params[:id]) 

這類似於

Model.where(user_id: current_user.id).find(params[:id]) 

如果你必須要經過幾個模型，以達到您的用戶模型，例如

class User < ApplicationRecord 
    has_one :test_one 
end 

class TestOne < ApplicationRecord 
    has_one :test_three 
    belongs_to :user 
end 

class TestThree < ApplicationRecord 
    has_many :test_fours 
    belongs_to :test_one 
end 

class TestFour < ApplicationRecord 
    belongs_to :test_three 
end 

您可以通過做一些像

TestFour.joins(:test_three => { :test_one => :user }).where(test_threes: { test_ones: { users: { id: current_user.id}}}).find(1) 
# TestFour Load (1.2ms) SELECT "test_fours".* FROM "test_fours" INNER JOIN "test_threes" ON "test_threes"."id" = "test_fours"."test_three_id" INNER JOIN "test_ones" ON "test_ones"."id" = "test_threes"."test_one_id" INNER JOIN "users" ON "users"."id" = "test_ones"."user_id" WHERE "users"."id" = $1 AND "test_fours"."id" = $2 LIMIT $3 [["id", 1], ["id", 1], ["LIMIT", 1]] 
#=> #<TestFour id: 1, test_three_id: 1, created_at: "2017-07-12 21:06:51", updated_at: "2017-07-12 21:06:51"> 

設置它在一個單一的查詢，然後，如果你這樣做有一個用戶ID /蟲蟲的ID不匹配：

TestFour.joins(:test_three => { :test_one => :user }).where(test_threes: { test_ones: { users: { id: current_user.id + 1}}}).find(1) 
# TestFour Load (0.8ms) SELECT "test_fours".* FROM "test_fours" INNER JOIN "test_threes" ON "test_threes"."id" = "test_fours"."test_three_id" INNER JOIN "test_ones" ON "test_ones"."id" = "test_threes"."test_one_id" INNER JOIN "users" ON "users"."id" = "test_ones"."user_id" WHERE "users"."id" = $1 AND "test_fours"."id" = $2 LIMIT $3 [["id", 2], ["id", 1], ["LIMIT", 1]] 
#=> ActiveRecord::RecordNotFound: Couldn't find TestFour with 'id'=1 [WHERE "users"."id" = $1]