1
我有鏈接訪問玩家的load_player視圖以訪問屬於current_user的玩家。那麼我該如何限制對沒有屬於其他用戶的俱樂部或俱樂部的current_user的load_player方法的訪問。注意我想限制訪問load_player頁面。授權使用cancancan的特定控制器操作
的routes.rb
get 'player/load_player/:id' => "player#load_player", as: :player
player_controller.rb
class PlayerController < ApplicationController
before_action :authenticate_user!
authorize_resource :class => false
layout "player"
def load_player
@club_hash = Club.where({:id => params[:id]}).pluck(:club_hash).first
end
end
ability.rb
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new # guest user (not logged in)
if user.is?(:admin)
can :manage, :all
elsif user.is?(:owner)
can :read, all: { except: [UploadedSong]}
can :manage, Club, user_id: user.id
can :read, :load_player, id: user.id
elsif user.is?(:user)
can :read, all: { except: [UploadedSong]}
end
end
end
謝謝@przbadu,這解決了我的問題。 – codemilan