I’m trying to write sort of a short-and-sweet authentication
permissions system. As it is right now, I know how I think I want it
to work but I’m having trouble making it escape the controller action
that was running if validation fails.
Controller in some action:
if belongs_to_current_user?(@article)
# User must have permission to edit their own article
permission_required(“article”, “edit”)
else
# User must have permission to edit other’s articles
permission_required(“article”, “edit-a”)
end
Application controller:
Denies access to unauthorized users.
def permission_required(cont, code)
unless permission?(cont, code)
flash[:warning] = “You don’t have the permission required for
access to this function”
redirect_to home_url
return false
end
end
The “return false” I have there, I want it cancel processing from the
action in my controller but it only cancels processing from the rest
of the permission_required method.
I’m at a loss as to how to put code safely after calling
permission_required in my controller, without worrying about it
getting executed anyway after the user is redirected.