# Before Filters

**URL:** <https://www.ruby-forum.com/t/before-filters/126815>\
**Category:** Rails\
**Created:** [January 22, 2008, 3:01pm UTC](https://www.ruby-forum.com/t/before-filters/126815 "2008-01-22T15:01:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![whitewolfaustria](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/bbce88/32.png) [@whitewolfaustria](https://www.ruby-forum.com/u/whitewolfaustria)\
**Post date:** [January 22, 2008, 3:01pm UTC](https://www.ruby-forum.com/t/before-filters/126815/1 "2008-01-22T15:01:06Z")

</div>

Hi all,  
I am having a slight problem with a before filter. I have a page  
that calls a before filter to create a set of methods to call my  
report generator based on if the person has permissions to the  
report. In development it seems to work fine, but in production I  
Only have access to one of the reports, It tells me that no action  
responded to the particular method being called. Being that I can  
get to the fist report, I know that it is working but failing on the  
second time through the loop.

code in the controller looks like this;

########################################################################################  
before\_filter :create\_report\_methods

def create\_report\_methods  
Report.find\_all.each do |r|  
HomeController.send :define\_method, “report\_#{r.id}” do  
redirect\_to(“[http://onetruth:8080/birt/frameset](http://onetruth:8080/birt/frameset)?  
\_\_report=#{r.name}.rptdesign”)  
end unless ReportMembership.find(:first,:conditions =\>  
[“report\_id = ? and memberable\_type = ‘TeamMember’ and memberable\_id  
= ?”, r.id, TeamMember.get\_team\_member.id]).nil? and  
ReportMembership.find\_by\_sql([“select \* from report\_memberships as rm,  
team\_members as tm, departments as d, department\_memberships as dm  
where rm.memberable\_type =‘Department’ and rm.memberable\_id = d.id and  
d.id = dm.department\_id and dm.team\_member\_id = tm.id and tm.id = ?  
and report\_id = ?”,TeamMember.get\_team\_member.id, r.id]).first.nil?  
end  
end

###########################################################################################  
It works as expected in development, so my question is could another  
user be going to the site through mongrel and changing the methods I  
have? Any help is appreciated with this issue of mine. (I will post  
the log entries once I find them, I am working in production on a  
test system)

White W.

---

<div class="post-metadata">

**Author:** ![whitewolfaustria](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/bbce88/32.png) [@whitewolfaustria](https://www.ruby-forum.com/u/whitewolfaustria)\
**Post date:** [January 22, 2008, 5:09pm UTC](https://www.ruby-forum.com/t/before-filters/126815/2 "2008-01-22T17:09:32Z")

</div>

On 22 Jan 2008, at 14:00, White W. wrote:

> \_\_report=#{r.name}.rptdesign")

yuck.

> ###########################################################################################  
> It works as expected in development, so my question is could another  
> user be going to the site through mongrel and changing the methods I  
> have? Any help is appreciated with this issue of mine. (I will post  
> the log entries once I find them, I am working in production on a  
> test system)

Quite possible. Another difference between development and production  
is that in development the classes are reloaded on each request.  
I have to wonder why you need a convoluted design like this, rather  
than have a single report action that generates the right thing base  
on the id parameter.

Fred

---

<div class="post-metadata">

**Author:** ![whitewolfaustria](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/bbce88/32.png) [@whitewolfaustria](https://www.ruby-forum.com/u/whitewolfaustria)\
**Post date:** [January 22, 2008, 6:51pm UTC](https://www.ruby-forum.com/t/before-filters/126815/3 "2008-01-22T18:51:35Z")

</div>

The thought behind this is for security reasons, if the user has a  
report method that parameters are passed to, a person could easily get  
a hold of reports that he should not be able to see. If I query the  
database, like I am doing here, I still run the risk of someone  
getting to the report. If I use everything behind the scenes like I  
currently am and define a method to called each report based on if  
you have permissions on that report it seems a little more secure than  
passing a number to a report function. I also don’t have to error  
check to see if the id is an integer and all the other fun stuff that  
goes along with that.

Anyways my boss liked it better this way. Also I noticed that I have  
permissions on all reports and I can only get to the first report, not  
the others that I have permission to. There is one other person that  
has permission has the same as I do. This is perplexing me a little  
bit.

White W.

---

<div class="post-metadata">

**Author:** ![whitewolfaustria](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/bbce88/32.png) [@whitewolfaustria](https://www.ruby-forum.com/u/whitewolfaustria)\
**Post date:** [January 22, 2008, 6:53pm UTC](https://www.ruby-forum.com/t/before-filters/126815/4 "2008-01-22T18:53:21Z")

</div>

BTW I do know that I need to refactor this code to prevent some CS  
attacks by taking and moving the finds into the models… .

WW

On Jan 22, 12:50 pm, White W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![whitewolfaustria](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/bbce88/32.png) [@whitewolfaustria](https://www.ruby-forum.com/u/whitewolfaustria)\
**Post date:** [January 22, 2008, 9:34pm UTC](https://www.ruby-forum.com/t/before-filters/126815/5 "2008-01-22T21:34:59Z")

</div>

On 22 Jan 2008, at 17:50, White W. wrote:

> goes along with that.

You’re adding no security, but you are adding rather a lot of  
complexity (and of course once you’ve added the methods for one user  
they’ll be there for every user. Of course you won’t notice that in  
development because classes are reloaded, so that a hole waiting to  
bite you)

If user has\_many :reports (via some join model that models who has  
been give access to what) then it’s as easy as

report = @logged\_in\_user.find(params[:id])  
if report  
report.run  
else  
#oops, you don’t have access to that report  
end

Fred

> Anyways my boss liked it better this way. Also I noticed that I have  
> permissions on all reports and I can only get to the first report, not  
> the others that I have permission to. There is one other person that  
> has permission has the same as I do. This is perplexing me a little  
> bit.