# Cancan e abilities per controller actions di una gem

**URL:** <https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179>\
**Category:** IT\
**Created:** [September 25, 2012, 10:22am UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179 "2012-09-25T10:22:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [September 25, 2012, 10:22am UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/1 "2012-09-25T10:22:54Z")

</div>

Salve.  
Non vorrei sbagliare ma le abilities di cancan controllano solo le 7  
canoniche actions? Cioe’ new, show, create, ecc.?  
Se volessi usarle per delle actions definite nei controllers di una  
gem e se in questi controller ci fossero delle custom actions come si  
puo’ fare?  
Non posso di certo andare a spulciare ogni controller per capire quali  
action vengono utilizzate per poterle inserire nelle abilities.

---

<div class="post-metadata">

**Author:** ![msan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@msan](https://www.ruby-forum.com/u/msan)\
**Post date:** [September 25, 2012, 1:53pm UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/2 "2012-09-25T13:53:48Z")

</div>

Non posso dirmi un grande esperto di CanCan ma visto che non ha ancora  
risposto nessuno ecco cosa ho trovato in un progetto a cui sto  
lavorando, impostato da altri prima di me.

app/models/ability

class Ability  
include CanCan::Ability

def initialize(user)  
user ||= User.new  
…  
can :change\_language, User  
…  
end  
end

app/controllers/users\_controller.rb

class UsersController \< ApplicationController

before\_filter :require\_user, :only =\> […, :change\_language]  
load\_and\_authorize\_resource

def change\_language  
# codice che cambia la lingua dell’utente @user  
# è chiamato con GET cliccando la bandierina nel menu lingue  
end

end

Quindi mi viene da dire che non serve nulla di particolare, basta  
chiamare il metodo can dentro l’initialize di Ability dandogli come  
argomento nome del metodo del controller e classe.

Paolo

Msan M. wrote in post #1077418:

> Salve.  
> Non vorrei sbagliare ma le abilities di cancan controllano solo le 7  
> canoniche actions? Cioe’ new, show, create, ecc.?  
> Se volessi usarle per delle actions definite nei controllers di una  
> gem e se in questi controller ci fossero delle custom actions come si  
> puo’ fare?  
> Non posso di certo andare a spulciare ogni controller per capire quali  
> action vengono utilizzate per poterle inserire nelle abilities.

---

<div class="post-metadata">

**Author:** ![msan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@msan](https://www.ruby-forum.com/u/msan)\
**Post date:** [September 25, 2012, 3:32pm UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/3 "2012-09-25T15:32:39Z")

</div>

2012/9/25 Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> ```
> user ||= User.new
> 
> ```
> 
> before\_filter :require\_user, :only =\> […, :change\_language]  
> chiamare il metodo can dentro l’initialize di Ability dandogli come  
> argomento nome del metodo del controller e classe.

Appunto quindi devo spulciare i controller utilizzati nella gem e  
indicare nelle abilities i metodi per i quali deve intervenire cancan?

---

<div class="post-metadata">

**Author:** ![msan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@msan](https://www.ruby-forum.com/u/msan)\
**Post date:** [September 25, 2012, 6:22pm UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/4 "2012-09-25T18:22:10Z")

</div>

2012/9/25 Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> S, soprattutto se blocchi tutto per default (che quello che  
> consiglio) con
> 
> class ApplicationController \< ActionController::Base  
> check\_authorization  
> end
> 
> Te lo consiglio sia come misura di sicurezza sia per accorgerti se stai  
> lasciando indietro qualcosa.

Infatti e’ quello che ho fatto.  
Ovviamente e’ sconsigliabile andare a modificare il codice di una gem  
per poter inserire in ogni controller load\_and\_authorize\_resource.  
Come potrei fare allora?

---

<div class="post-metadata">

**Author:** ![msan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@msan](https://www.ruby-forum.com/u/msan)\
**Post date:** [September 25, 2012, 5:39pm UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/5 "2012-09-25T17:39:58Z")

</div>

Sì, soprattutto se blocchi tutto per default (che è quello che  
consiglio) con

class ApplicationController \< ActionController::Base  
check\_authorization  
end

Te lo consiglio sia come misura di sicurezza sia per accorgerti se stai  
lasciando indietro qualcosa.

Paolo

Msan M. wrote in post #1077464:

> 2012/9/25 Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):
> 
> > ```
> > user ||= User.new
> > 
> > ```
> > 
> > before\_filter :require\_user, :only =\> […, :change\_language]  
> > chiamare il metodo can dentro l’initialize di Ability dandogli come  
> > argomento nome del metodo del controller e classe.
> 
> Appunto quindi devo spulciare i controller utilizzati nella gem e  
> indicare nelle abilities i metodi per i quali deve intervenire cancan?

---

<div class="post-metadata">

**Author:** ![msan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3ab097/32.png) [@msan](https://www.ruby-forum.com/u/msan)\
**Post date:** [September 25, 2012, 7:40pm UTC](https://www.ruby-forum.com/t/cancan-e-abilities-per-controller-actions-di-una-gem/223179/6 "2012-09-25T19:40:30Z")

</div>

Nel progetto su cui sto lavorando non tutti i controller hanno bisogno  
del load\_and\_authorize\_resource. Alcuni hanno solo l’authorize\_resource  
altri non hanno nulla.

Ho googlato uno che l’aveva messo in ApplicationController ma aveva  
avuto un problema con devise (2 anni fa) e gli hanno anche risposto che  
non è l’approccio consigliato.

> <https://github.com/ryanb/cancan/issues/138>
>
> Hello,
> 
> I am trying to protect every controller of my application, therefore I h…ave added "load\_and\_authorize\_resource" into my application controller. However, now the Devise action for sign\_in etc does not work. Here is entry from my log:
> 
> \`\`\`
> Started GET "/users/sign\_in" for 127.0.0.1 at 2010-09-01 00:38:31 +0200
> Processing by Devise::SessionsController#new as HTML
> Completed in 9ms
> 
> NameError (uninitialized constant Session):
> 
> 
> Rendered C:/Users/vita/.pik/rubies/Ruby-192-p0/lib/ruby/gems/1.9.1/gems/actionpack-3.0.0/lib/action\_dispatch/middleware/templates/rescues/\_trace.erb (1.0ms)
> Rendered C:/Users/vita/.pik/rubies/Ruby-192-p0/lib/ruby/gems/1.9.1/gems/actionpack-3.0.0/lib/action\_dispatch/middleware/templates/rescues/\_request\_and\_response.erb (91.0ms)
> Rendered C:/Users/vita/.pik/rubies/Ruby-192-p0/lib/ruby/gems/1.9.1/gems/actionpack-3.0.0/lib/action\_dispatch/middleware/templates/rescues/diagnostics.erb within rescues/layout (109.0ms)
> \`\`\`
> 
> and the call stack:
> 
> \`\`\`
> activesupport (3.0.0) lib/active\_support/inflector/methods.rb:124:in \`block in constantize'
> activesupport (3.0.0) lib/active\_support/inflector/methods.rb:123:in \`each'
> activesupport (3.0.0) lib/active\_support/inflector/methods.rb:123:in \`constantize'
> activesupport (3.0.0) lib/active\_support/core\_ext/string/inflections.rb:43:in \`constantize'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:83:in \`resource\_class'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:100:in \`resource\_base'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:54:in \`build\_resource'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:46:in \`load\_resource\_instance'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:30:in \`load\_resource'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:24:in \`load\_and\_authorize\_resource'
> cancan (1.3.3) lib/cancan/controller\_resource.rb:9:in \`block in add\_before\_filter'
> activesupport (3.0.0) lib/active\_support/callbacks.rb:446:in \`\_run\_\_192464393\_\_process\_action\_\_1059523234\_\_callbacks'
> activesupport (3.0.0) lib/active\_support/callbacks.rb:409:in \`\_run\_process\_action\_callbacks'
> activesupport (3.0.0) lib/active\_support/callbacks.rb:93:in \`run\_callbacks'
> actionpack (3.0.0) lib/abstract\_controller/callbacks.rb:17:in \`process\_action'
> actionpack (3.0.0) lib/action\_controller/metal/instrumentation.rb:30:in \`block in process\_action'
> activesupport (3.0.0) lib/active\_support/notifications.rb:52:in \`block in instrument'
> activesupport (3.0.0) lib/active\_support/notifications/instrumenter.rb:21:in \`instrument'
> activesupport (3.0.0) lib/active\_support/notifications.rb:52:in \`instrument'
> actionpack (3.0.0) lib/action\_controller/metal/instrumentation.rb:29:in \`process\_action'
> actionpack (3.0.0) lib/action\_controller/metal/rescue.rb:17:in \`process\_action'
> actionpack (3.0.0) lib/abstract\_controller/base.rb:119:in \`process'
> actionpack (3.0.0) lib/abstract\_controller/rendering.rb:40:in \`process'
> actionpack (3.0.0) lib/action\_controller/metal.rb:133:in \`dispatch'
> actionpack (3.0.0) lib/action\_controller/metal/rack\_delegation.rb:14:in \`dispatch'
> actionpack (3.0.0) lib/action\_controller/metal.rb:173:in \`block in action'
> actionpack (3.0.0) lib/action\_dispatch/routing/route\_set.rb:62:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/routing/route\_set.rb:62:in \`dispatch'
> actionpack (3.0.0) lib/action\_dispatch/routing/route\_set.rb:27:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/routing/mapper.rb:34:in \`call'
> rack-mount (0.6.12) lib/rack/mount/route\_set.rb:148:in \`block in call'
> rack-mount (0.6.12) lib/rack/mount/code\_generation.rb:93:in \`block in recognize'
> rack-mount (0.6.12) lib/rack/mount/code\_generation.rb:68:in \`optimized\_each'
> rack-mount (0.6.12) lib/rack/mount/code\_generation.rb:92:in \`recognize'
> rack-mount (0.6.12) lib/rack/mount/route\_set.rb:139:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/routing/route\_set.rb:492:in \`call'
> warden (0.10.7) lib/warden/manager.rb:35:in \`block in call'
> warden (0.10.7) lib/warden/manager.rb:34:in \`catch'
> warden (0.10.7) lib/warden/manager.rb:34:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/best\_standards\_support.rb:17:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/head.rb:14:in \`call'
> rack (1.2.1) lib/rack/methodoverride.rb:24:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/params\_parser.rb:21:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/flash.rb:182:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/session/abstract\_store.rb:149:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/cookies.rb:287:in \`call'
> activerecord (3.0.0) lib/active\_record/query\_cache.rb:32:in \`block in call'
> activerecord (3.0.0) lib/active\_record/connection\_adapters/abstract/query\_cache.rb:28:in \`cache'
> activerecord (3.0.0) lib/active\_record/query\_cache.rb:12:in \`cache'
> activerecord (3.0.0) lib/active\_record/query\_cache.rb:31:in \`call'
> activerecord (3.0.0) lib/active\_record/connection\_adapters/abstract/connection\_pool.rb:355:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/callbacks.rb:46:in \`block in call'
> activesupport (3.0.0) lib/active\_support/callbacks.rb:415:in \`\_run\_call\_callbacks'
> actionpack (3.0.0) lib/action\_dispatch/middleware/callbacks.rb:44:in \`call'
> rack (1.2.1) lib/rack/sendfile.rb:107:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/remote\_ip.rb:48:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/show\_exceptions.rb:46:in \`call'
> railties (3.0.0) lib/rails/rack/logger.rb:13:in \`call'
> rack (1.2.1) lib/rack/runtime.rb:17:in \`call'
> activesupport (3.0.0) lib/active\_support/cache/strategy/local\_cache.rb:72:in \`call'
> rack (1.2.1) lib/rack/lock.rb:11:in \`block in call'
> \<internal:prelude\>:10:in \`synchronize'
> rack (1.2.1) lib/rack/lock.rb:11:in \`call'
> actionpack (3.0.0) lib/action\_dispatch/middleware/static.rb:30:in \`call'
> railties (3.0.0) lib/rails/application.rb:168:in \`call'
> railties (3.0.0) lib/rails/application.rb:77:in \`method\_missing'
> railties (3.0.0) lib/rails/rack/log\_tailer.rb:14:in \`call'
> rack (1.2.1) lib/rack/content\_length.rb:13:in \`call'
> rack (1.2.1) lib/rack/chunked.rb:15:in \`call'
> rack (1.2.1) lib/rack/handler/mongrel.rb:67:in \`process'
> mongrel-1.2.0.pre2-x86 (mingw32) lib/mongrel.rb:165:in \`block in process\_client'
> mongrel-1.2.0.pre2-x86 (mingw32) lib/mongrel.rb:164:in \`each'
> mongrel-1.2.0.pre2-x86 (mingw32) lib/mongrel.rb:164:in \`process\_client'
> mongrel-1.2.0.pre2-x86 (mingw32) lib/mongrel.rb:291:in \`block (2 levels) in run'
> \`\`\`
> 
> I tried to use
> 
> \`\`\`
> skip\_before\_filter :load\_and\_authorize\_resource
> \`\`\`
> 
> in devise-1.1.2\\app\\controllers\\devise\\sessions\_controller.rb but without success. Could you help me please?
> 
> Vit

Mi sa che dovrai metterli a mano o farti uno script in Ruby per  
aggiungere la riga 🙂

Paolo

Msan M. wrote in post #1077494:

> 2012/9/25 Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):
> 
> > S, soprattutto se blocchi tutto per default (che quello che  
> > consiglio) con
> > 
> > class ApplicationController \< ActionController::Base  
> > check\_authorization  
> > end
> > 
> > Te lo consiglio sia come misura di sicurezza sia per accorgerti se stai  
> > lasciando indietro qualcosa.
> 
> Infatti e’ quello che ho fatto.  
> Ovviamente e’ sconsigliabile andare a modificare il codice di una gem  
> per poter inserire in ogni controller load\_and\_authorize\_resource.  
> Come potrei fare allora?