# Block certain users from doing tasks

**URL:** <https://www.ruby-forum.com/t/block-certain-users-from-doing-tasks/110712>\
**Category:** Rails\
**Created:** [July 30, 2007, 2:55am UTC](https://www.ruby-forum.com/t/block-certain-users-from-doing-tasks/110712 "2007-07-30T02:55:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dark-omen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c68b51/32.png) [@dark-omen](https://www.ruby-forum.com/u/dark-omen)\
**Post date:** [July 30, 2007, 2:55am UTC](https://www.ruby-forum.com/t/block-certain-users-from-doing-tasks/110712/1 "2007-07-30T02:55:31Z")

</div>

So I have an account manager for users on my site and it has their  
profile which just displays their information, and a place where they  
can edit their info, the problem I am having is right now a person can  
edit anyone’s profile, so I obviously want to make it so they can only  
edit their own profile. In my controller I added an if statement that  
would check to see if the user was editing their profile which went like  
this:

def edit  
id = params[:id]  
if session[:user\_id] == id  
begin  
@user = User.find\_by\_id(id)  
rescue  
flash[:notice] = “No user by that user id can be found”  
redirect\_to(:controller =\> ‘home’, :action =\> ‘index’)  
end  
else  
flash[:notice] = “You are not authorized to edit this user”  
redirect\_to(:controller =\> ‘account’, :action =\> ‘profile’, :id =\> id)  
end  
end

But that always gives me the message that I have set as my flash and  
takes me to the profile that was trying to be edited (even if the  
profile was my own).  
Any suggestions?