# Blocking/accepting params according to @member.admin?

**URL:** <https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165>\
**Category:** Rails\
**Created:** [November 7, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165 "2006-11-07T22:21:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@joe](https://www.ruby-forum.com/u/joe)\
**Post date:** [November 7, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165/1 "2006-11-07T22:21:27Z")

</div>

I have a submission form that displays additional fields if the  
logged-in member is an admin. To be secure, I don’t want these  
particular params to be accepted at all (when the form is submitted) if  
the member isn’t an admin. Any thoughts on how to do this? The model  
doesn’t seem the correct place to mess with params (what I want is like  
attr\_protected, but according to @member.admin). I’m not interested in  
having separate views/controllers for basically the same form.

Thanks,  
Joe

---

<div class="post-metadata">

**Author:** ![joe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@joe](https://www.ruby-forum.com/u/joe)\
**Post date:** [November 7, 2006, 10:42pm UTC](https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165/2 "2006-11-07T22:42:29Z")

</div>

If the parameters are associated with a model, like a submissions  
title, dates, etc, they could be edited in the model itself. I have a  
model and put all its editing in the validate() method. Even some  
control-only parameters (not stored in the DB as member attributes) are  
defined in the attr\_accessor/acccessible sections, and are passed from  
the view. It works well, as I don’t have to worry about any validation  
code in the views/controllers. I figure every object validates itself.

If you took this approach, you can try a control-only variable on the  
form @member\_level which stores the current member level, and have an  
accessor for it in the submission model. then add any code in the  
validate() method which checks the member\_level. This is assuming its  
up to the submission to know what each member-level can do to it.

As far as not showing the fields on the view for non-admins, just put  
the code in a partial and check it there. You can call the partial  
from any controllers view. I have a shared view folder and call it  
from different views:  
\<%= render :partial =\> ‘shared/top\_menu’ %\>

---

<div class="post-metadata">

**Author:** ![joe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@joe](https://www.ruby-forum.com/u/joe)\
**Post date:** [November 8, 2006, 2:47am UTC](https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165/3 "2006-11-08T02:47:14Z")

</div>

One correction to my previous post… I went back and checked the  
code… I don’t get the member\_level value from the form. Ths would be  
insecure as anybody can pass a higher level. I get the member.id from  
session[:member\_id] and look up the user in the DB and retrieve the  
member\_level. You can also store it in session[:member\_level].

Bart

---

<div class="post-metadata">

**Author:** ![joe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b9e5f3/32.png) [@joe](https://www.ruby-forum.com/u/joe)\
**Post date:** [November 7, 2006, 11:08pm UTC](https://www.ruby-forum.com/t/blocking-accepting-params-according-to-member-admin/75165/4 "2006-11-07T23:08:33Z")

</div>

Hey,

see: [Parked at Loopia](http://blog.caboo.se/articles/2006/06/11/stupid-hash-tricks)

HTH,  
Trevor