Forum: Rails Engines How to limit some HTML blocks for a certain role/permission?

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
Piotr U. (Guest)
on 2006-03-28 17:11
(Received via mailing list)
Hi

	I have a small problem here. I have few roles, eg. Client User and
Client Manager. I would like to let view both of them a certain View,
but normal Client User shall not see any blocks of HTML code like
payment lists etc. on a page. How can I achieve this?

Piotr
James A. (Guest)
on 2006-03-28 18:06
(Received via mailing list)
You can use something like this in a view:

<% if current_user.roles.include?(Role.find_by_name("Client Manager") do
%>
   <!-- your html here -->
<% end %>

Would that be ok? This presumes that you're using the User Engine...

- james

On 3/28/06, Piotr U. <removed_email_address@domain.invalid> wrote:
> engine-users mailing list
> removed_email_address@domain.invalid
> http://lists.rails-engines.org/listinfo.cgi/engine...
>


--
* J *
  ~
Piotr U. (Guest)
on 2006-03-28 18:30
(Received via mailing list)
James A. napisaÅ?(a):
> You can use something like this in a view:
>
> <% if current_user.roles.include?(Role.find_by_name("Client Manager") do %>
>    <!-- your html here -->
> <% end %>
>
> Would that be ok? This presumes that you're using the User Engine...
>

Yeah, I have figured it out. But still, it won't work as expected.

My application shall grant access to 'our' users, and our client's
users.

So our users arent assigned to Client roles, but instead like Helpdesk
Users or whatever.

Here, if a certain user (or admin) arent assigned Client Manager role
won't see the block aswell... Which is not the way it should be.

Any solution? :)

Peter
Jonathan Bloch (Guest)
on 2006-03-29 06:54
Sure... a hack of sorts.  Just make some  permissions for "fake"
controllers & actions (that need not  exist/do anything useful). Then
assign these permissions to the roles you want and use the authorized?
method. This gives arbitrarily fine-grained control:

<% if authorized?(:controller =>'htmlacesscheck' :action =>
'thisbitofhtml') %>
    <!-- Private HTML -->
<% end %>


Piotr U. wrote:
>> Yeah, I have figured it out. But still, it won't work as expected.
>
> My application shall grant access to 'our' users, and our client's
> users.
>
> So our users arent assigned to Client roles, but instead like Helpdesk
> Users or whatever.
>
> Here, if a certain user (or admin) arent assigned Client Manager role
> won't see the block aswell... Which is not the way it should be.
>
> Any solution? :)
>
> Peter
Piotr U. (Guest)
on 2006-03-29 11:36
(Received via mailing list)
Jonathan Bloch napisaÅ?(a):
>
>

Oh thanks. But it's nasty! ;]

Peter
James A. (Guest)
on 2006-03-29 11:45
(Received via mailing list)
If a set of users all need to see the same chunk of HTML, they should
share the same role. Importantly, though, bear in mind that users can
have MANY roles. So define your roles in a sensible way which reflects
the fine granularity of what information they should/should not see,
and use these presence/absence of those fine-grained roles in your
conditional statements.

- james

On 3/29/06, Piotr U. <removed_email_address@domain.invalid> wrote:
> >
> http://lists.rails-engines.org/listinfo.cgi/engine...
>


--
* J *
  ~
Piotr U. (Guest)
on 2006-03-29 14:39
(Received via mailing list)
James A. napisa³(a):
> If a set of users all need to see the same chunk of HTML, they should
> share the same role. Importantly, though, bear in mind that users can
> have MANY roles. So define your roles in a sensible way which reflects
> the fine granularity of what information they should/should not see,
> and use these presence/absence of those fine-grained roles in your
> conditional statements.
>
> - james
>

Yes I know, but it would be somewhat difficult to administer all the
users (for example, we have about 20 internal users and 300+ external
ones). Setting many different roles for eg. every variable of html code
chunks can be annoying. I am not sure, but maybe ActiveRBAC would let
this be less complicated.
James A. (Guest)
on 2006-03-29 14:54
(Received via mailing list)
Perhaps roles are not the right metaphor for the kind of discriminant
functionality or display that you need. Good luck.

- james

On 3/29/06, Piotr U. <removed_email_address@domain.invalid> wrote:
>
>
--
* J *
  ~
Shane Iseminger (Guest)
on 2006-08-30 21:59
(Received via mailing list)
Hello all,

Has anyone tried to use the UserEngine alongside the upload progress
plugin? We have everything working correctly for both of those, but
we're finding that when a user is logged in, the ajax requests used
in the upload plugin get hung up. They never return anything, and I
have to kill off the fcgi processes it kicks up manually.

The strange thing is that if the user logs out, everything works fine.

I've tried changing the protect? method of the LoginEngine's
user_controller.rb so that ostensibly the controller handling those
ajax requests isn't protected, but that still doesn't seem to make
any difference.

Anyone else have this experience?


__________________________________

	Shane Iseminger
	Principal
	Ethos Media Creative Group
	removed_email_address@domain.invalid
	719.589.2800
Jay L. (Guest)
on 2006-08-31 02:28
(Received via mailing list)
On Wed, 30 Aug 2006 11:58:13 -0600, Shane Iseminger wrote:

> Has anyone tried to use the UserEngine alongside the upload progress
> plugin? We have everything working correctly for both of those, but
> we're finding that when a user is logged in, the ajax requests used
> in the upload plugin get hung up. They never return anything, and I
> have to kill off the fcgi processes it kicks up manually.

I had them both working in an app that no longer exists... sorry that
doesn't give you much detail, but at least you know they CAN work.  No
idea
what's different about your situation.

Jay L.
Shane Iseminger (Guest)
on 2006-08-31 06:10
(Received via mailing list)
Thanks Jay,

After a lot of excruciating tracing and debugging, I deduced that
part of the upload progress plugin is loading the session, but the
Role model stored in it was undefined. So all it ended up requiring
is the line

	require 'roles.rb'

in multipart_progress.rb, right before it loads the session. By the
way, this problem shows itself in the logs as the following error,
which someone (I believe here) had tried to solve a while ago (I ran
across it in Google):

	"Exception during setup of read_multipart_with_progress: undefined
class/module Role"

-- Shane


On Aug 30, 2006, at 4:27 PM, Jay L. wrote:

> No idea
> what's different about your situation.
>
> Jay L.
>
> _______________________________________________
> engine-users mailing list
> removed_email_address@domain.invalid
> http://lists.rails-engines.org/listinfo.cgi/engine...
> engines.org

__________________________________

	Shane Iseminger
	Principal
	Ethos Media Creative Group
	removed_email_address@domain.invalid
	719.589.2800
This topic is locked and can not be replied to.