# Application security fun

**URL:** <https://www.ruby-forum.com/t/application-security-fun/155395>\
**Category:** Rails\
**Created:** [December 11, 2008, 12:47pm UTC](https://www.ruby-forum.com/t/application-security-fun/155395 "2008-12-11T12:47:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dnstevenson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8dc957/32.png) [@dnstevenson](https://www.ruby-forum.com/u/dnstevenson)\
**Post date:** [December 11, 2008, 12:47pm UTC](https://www.ruby-forum.com/t/application-security-fun/155395/1 "2008-12-11T12:47:24Z")

</div>

Hello,

I am trying to develop an application that uses STI for People. So you  
have customer \< person, admin \< person. I have also created a login  
controller with accompanying simple login page (un & pw fields).

* * *

Login Controller

def do\_login  
username = params[:username]  
password = params[:password]

```
if username.nil? || password.nil? || username==password
redirect_to :action => "login"
flash[:notice] = 'Unknown user or invalid password'

```

## else session[“user\_id”] = username redirect\_to :controller =\> “customers”, :action =\> “index” end

Currently it just checks if something is entered into the boxes to test  
that it works. I have created a register page that adds a record to the  
database table people an email address, hashed password, and salt. What  
i want to do is check these when a user enters a username and password  
in the login page but am not quite sure what to do.

I currently only have customer and admin controllers. Do i need to  
create a people controller? or can i reference the database from the  
login controller?

Any help would be great !!!

Regards,

Dave

---

<div class="post-metadata">

**Author:** ![dnstevenson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8dc957/32.png) [@dnstevenson](https://www.ruby-forum.com/u/dnstevenson)\
**Post date:** [December 11, 2008, 12:51pm UTC](https://www.ruby-forum.com/t/application-security-fun/155395/2 "2008-12-11T12:51:45Z")

</div>

On 11 Dec 2008, at 11:47, Dave S. wrote:

> I currently only have customer and admin controllers. Do i need to  
> create a people controller? or can i reference the database from the  
> login controller?

controllers aren’t tied to models. Any controller can use any model to  
do anything.

Fred

---

<div class="post-metadata">

**Author:** ![dnstevenson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/8dc957/32.png) [@dnstevenson](https://www.ruby-forum.com/u/dnstevenson)\
**Post date:** [December 11, 2008, 1:19pm UTC](https://www.ruby-forum.com/t/application-security-fun/155395/3 "2008-12-11T13:19:58Z")

</div>

Frederick C. wrote:

> On 11 Dec 2008, at 11:47, Dave S. wrote:
> 
> > I currently only have customer and admin controllers. Do i need to  
> > create a people controller? or can i reference the database from the  
> > login controller?
> 
> controllers aren’t tied to models. Any controller can use any model to  
> do anything.
> 
> Fred

excellent… sorted… cheers