设计不控制确切的编辑用户的编号

Question

我在轨应用程序中安装设计。如果用户登录，他可以访问所有其他用户编辑页面。

例如，我是user_id 2，我可以编辑用户的配置文件1/3/4/5 .....当我在路线中手动修改参数。

这里我的应用程序控制器：

class ApplicationController < ActionController::Base 
    protect_from_forgery 
    before_action :authenticate_user! 

    before_action :configure_permitted_parameters, if: :devise_controller? 

    def configure_permitted_parameters 
    # For additional fields in app/views/devise/registrations/new.html.erb 
    devise_parameter_sanitizer.permit(:sign_up, keys: [:first_name, :last_name, :company, :position, :office_phone, :mobile_phone, :address, :description, :radius, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []]) 

    # For additional in app/views/devise/registrations/edit.html.erb 
    devise_parameter_sanitizer.permit(:account_update, keys: [:first_name, :last_name, :company, :position, :office_phone, :mobile_phone, :address, :description, :radius, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []]) 
    end 
end 

这里我的用户控制器：

class UsersController < ApplicationController 

    skip_before_action :authenticate_user!, only: [:index, :show] 
    before_action :set_user, only: [:show, :edit, :update] 

    def index 
    @client = Client.new 

    @users = User.all 
    @users = User.where.not(latitude: nil, longitude: nil) 

    @hash = Gmaps4rails.build_markers(@users) do |user, marker| 
     marker.lat user.latitude 
     marker.lng user.longitude 
    end 

    end 

    def show 
    @client = Client.new 
    @user = User.find(params[:id]) 
    end 

    def new 
    @user = User.new 
    end 

    def create 
    @user = User.new(user_params) 
    @user.save 

    redirect_to users_path 
    end 


    def edit 
    @user = User.find(params[:id]) 
    end 

    def update 
    @user = User.find(params[:id]) 
    @user.update(user_params) 

    redirect_to user_path(@user) 
    end 


    private 

    def user_params 
    params.require(:user).permit(:company, :first_name, :last_name, :position, :mobile_phone, :office_phone, :email, :address, :description, :radius, :nettoyage_toiture, :photo_company_logo, :photo_presentation, photos_projet_1: [], photos_projet_2: [], photos_projet_3: [], photos_projet_4: []) 
    end 

    def set_user 
    @user = User.find(params[:id]) 
    end 

end 

这里亩用户模式：

class User < ApplicationRecord 
    has_attachment :photo_presentation 
    has_attachment :photo_company_logo 
    has_many :projects, dependent: :nullify 
    # Include default devise modules. Others available are: 
    # :confirmable, :lockable, :timeoutable and :omniauthable 
    devise :database_authenticatable, :registerable, 
    :recoverable, :rememberable, :trackable, :validatable 
    #geocoder for google maps 
    geocoded_by :address 
    after_validation :geocode, if: :address_changed? 
end 

这里我的路线：

Rails.application.routes.draw do 
    ActiveAdmin.routes(self) 
    devise_for :users 
    root to: 'pages#home' 
    resources :users do 
    resources :projects 
    end 
    resources :clients, only: [:new, :create, :show] 
    mount Attachinary::Engine => "/attachinary" 
    # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html 
end 

非常感谢！

Answer 1

Devise是一个认证库。您有授权问题。所以，你应该使用一些授权。我使用CanCan。有了它，你可以定义的权限是这样的：

can :edit, User, id: current_user.id 

如果你不想学习另一个库，你总是可以做贫民区授权在控制器中。

class UsersController 
    before_action :can_edit_only_self, only: [:edit, :update, :destroy] 

    private 

    def can_edit_only_self 
    redirect_to root_path unless params[:id] == current_user.id 
    end 
end 

---

_{*认证 - 我知道你是谁}

_{*授权 - 我知道你被允许这样做}

Answer 2

问题是这样的：

def edit 
    @user = User.find(params[:id]) 
end 

def update 
    @user = User.find(params[:id]) 
    @user.update(user_params) 

    redirect_to user_path(@user) 
end 

如果你不希望用户能够编辑其他用户，那么你不需要这两种方法。你也可以改变你的路线文件：

resources :users, except: [:edit, :update] do 
    resources :projects 
end 

更新

如果您以前的编辑，并在终端类型rake routes，你应该看到，设计为编辑用户的控制器操作。它应该是users/edit没有:id参数。在Devise :: RegistrationsController中，编辑方法应该只使用current_user辅助方法来编辑当前登录用户的帐户信息。

如果你想admin用户能够编辑其他用户，那么你要了解以下宝石

1. Can Can
2. Pundit

有了这些宝石之一您可以定义哪些用户“角色”可以根据其角色编辑其他用户。您还可以使用这些宝石来授予创建，读取，更新，删除其他资源的权限。