# Creating a secure area?

**URL:** <https://www.ruby-forum.com/t/creating-a-secure-area/67733>\
**Category:** Radiant CMS\
**Created:** [September 6, 2006, 1:07pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733 "2006-09-06T13:07:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jake\_Liddell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e9a140/32.png) [@Jake\_Liddell](https://www.ruby-forum.com/u/Jake_Liddell)\
**Post date:** [September 6, 2006, 1:07pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733/1 "2006-09-06T13:07:45Z")

</div>

Hi all,

I’d like to create a /members section of my site, which will only be  
viewable to members who have logged on. (These members could either be  
a  
new sub-category of radiant users, or could be a completely different  
list,  
either stored within the website database, or on the filesystem - I  
don’t  
really care about the admin so long as the functionality works.)

Has anyone done this? Can you give me some help or instructions to  
implement the same?

Thanks a lot,

Jake.

---

<div class="post-metadata">

**Author:** ![Jake\_Liddell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e9a140/32.png) [@Jake\_Liddell](https://www.ruby-forum.com/u/Jake_Liddell)\
**Post date:** [September 6, 2006, 1:29pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733/2 "2006-09-06T13:29:38Z")

</div>

I’m currently doing something similar, although I am using a completely  
different user system to what radiant uses as default (it’s basically a  
modified version of acts\_as\_authenticated and authorization plugins).

All I’ve done so far is create some custom tags that allow me to show  
content based on a users roles…

* * *

### USER TAGS

```
current_user ||= request.session[:user] ? 

```

User.find(request.session[:user]) : nil

```
# This creates the <r:current_user/> namespace.
tag "current_user", :for => current_user, :expose => ['username',
                                                      'email',
                                                      'fullname',
                                                      'displayname',
                                                      'fistname',
                                                      'lastname']

tag "if_current_user" do |tag|
  if current_user
    tag.expand
  end
end

tag "unless_current_user" do |tag|
  unless current_user
    tag.expand
  end
end

tag "if_user_has_role" do |tag|
  if current_user && (eval "current_user.is_#{tag.attr['role']}?")
    tag.expand
  end
end

```

* * *

and implement a basic login box that can be shown on all pages:

* * *

class AccountBehavior \< Behavior::Base

register ‘Account System’

description %{  
The Account System behaviour allows users to sign-up, login and  
modify their account details  
}

def find\_page\_by\_url(url, live = true, clean = false)  
@action = url.sub(@page.url, ‘’).sub(//$/, ‘’)  
return @page  
end

def render\_page  
case @action  
when ‘login’  
if request.post?  
process\_login  
else  
render\_standard\_page  
end  
when ‘logout’  
process\_logout  
when ‘register’  
else  
render\_standard\_page  
end  
end

def render\_standard\_page  
lazy\_initialize\_parser\_and\_context  
if layout = @page.layout  
parse\_object(layout)  
else  
render\_page\_part(:body)  
end  
end

def process\_login  
user = User.authenticate( request.parameters[:username],  
request.parameters[:password] )  
if user.nil?  
#flash.now[:error] = ‘Supplied username or password is incorrect’  
else  
request.session[:user] = user.id  
render\_standard\_page  
end  
end

def process\_logout  
request.session[:user] = nil  
render\_standard\_page  
end

def process\_register  
end

define\_tags do

```
url = request.request_uri unless request.nil?

# This is just for creating the <r:account/> namespace.
tag "account" do |tag|
  tag.expand
end

```

end

## end

my loginbox snippet then has the following:

* * *

\<r:if\_current\_user\>

## Welcome back \<r:current\_user:fullname /\>
  

Not \<r:current\_user:fullname /\>? Then please [logout](https://www.ruby-forum.com/account/logout)

  
\</r:if\_current\_user\>

\<r:unless\_current\_user\>

## Existing User Login
  
  

Username

  

Password

  

  
[Why register?](https://www.ruby-forum.com/account/login)  

  

  
  

  
  
\</r:unless\_current\_user\>

--------------------

I have yet to code the registration form or the ability for users to  
modify their details. However, this does allow me to let admin users  
login directly from any page and once logged in have a direct link to  
the admin area.

Much of the above may be buggy and full of bad practices as I’m fairly  
new to Ruby, Rails and especially some of the more advanced stuff that  
is going on throughout radiant. I hope it provides some ideas though.

Kev

---

<div class="post-metadata">

**Author:** ![Jake\_Liddell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e9a140/32.png) [@Jake\_Liddell](https://www.ruby-forum.com/u/Jake_Liddell)\
**Post date:** [September 6, 2006, 2:31pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733/3 "2006-09-06T14:31:51Z")

</div>

There is also a nice behaviour for password-based access control to site  
pages, which unfortunately, as the mailer one, doesn’t seem to work  
out-of-the box with the current radiant release. It has been coded by  
Matt  
McCray. Hope someone will upgrade those plugins: I’m unable to do it by  
myself ☹  
–M

---

<div class="post-metadata">

**Author:** ![Jake\_Liddell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e9a140/32.png) [@Jake\_Liddell](https://www.ruby-forum.com/u/Jake_Liddell)\
**Post date:** [September 6, 2006, 5:56pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733/4 "2006-09-06T17:56:26Z")

</div>

Hi,  
I’ve done something similar based on  
auth\_generator[http://penso.info/rails/auth\_generator/](http://penso.info/rails/auth_generator/),  
I created behaviors for:

- login
- logout
- user profile editing
- invite a friend
- webiste invitations for emails we already have in our DB
- Register page
- restricted behavior - obviously restricting entry to none registered  
users
- and a Forums and thredas behaviors - which are the initial reason for  
all  
of this

This has entered a very small friendly users test, and hopefuly I’ll be  
able  
to release it in a week or so.  
Dror

---

<div class="post-metadata">

**Author:** ![Jake\_Liddell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e9a140/32.png) [@Jake\_Liddell](https://www.ruby-forum.com/u/Jake_Liddell)\
**Post date:** [September 6, 2006, 11:01pm UTC](https://www.ruby-forum.com/t/creating-a-secure-area/67733/5 "2006-09-06T23:01:05Z")

</div>

Hi Dror,

This sounds exactly the kind of functionality I?d be interested in. If  
you  
need any more testers, and can hand-hold me a little in installing, I?m  
happy to help you test. We have a brand new website for a community  
group  
that I?m working on, so I have a free reign to work with a group of  
sympathetic users. If you?re fine,

I look forward to your release!

Best regards,

Jake.

È +44 (0) 7786 808 800

: HYPER:-(IN:-| "[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)"removed\_email\_address@domain.invalid

* * *

From: removed\_email\_address@domain.invalid  
[[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] On Behalf Of dror tirosh  
Sent: 06 September 2006 16:56  
To: removed\_email\_address@domain.invalid  
Subject: Re: [Radiant] Creating a secure area?

Hi,  
I’ve done something similar based on HYPER:-(IN:-|  
"[http://penso.info/rails/auth\_generator/](http://penso.info/rails/auth_generator/)"auth\_generator, I created  
behaviors  
for:

- login
- logout
- user profile editing
- invite a friend
- webiste invitations for emails we already have in our DB
- Register page
- restricted behavior - obviously restricting entry to none registered  
users
- and a Forums and thredas behaviors - which are the initial reason for  
all  
of this

This has entered a very small friendly users test, and hopefuly I’ll be  
able  
to release it in a week or so.  
Dror

On 9/6/06, Maurizio B. \<HYPER:-(IN:-|  
"[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)"removed\_email\_address@domain.invalid\> wrote:

There is also a nice behaviour for password-based access control to site  
pages, which unfortunately, as the mailer one, doesn’t seem to work  
out-of-the box with the current radiant release. It has been coded by  
Matt  
McCray. Hope someone will upgrade those plugins: I’m unable to do it by  
myself ☹

–M

On 9/6/06, :-|evin Ansfield \<HYPER:-(IN:-|  
“[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)” \removed\_email\_address@domain.invalid\> wrote:

I’m currently doing something similar, although I am using a completely  
different user system to what radiant uses as default (it’s basically a  
modified version of acts\_as\_authenticated and authorization plugins).

All I’ve done so far is create some custom tags that allow me to show  
content based on a users roles…

* * *

Radiant mailing list  
HYPER:-(IN:-|  
"[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)"removed\_email\_address@domain.invalid  
HYPER:-(IN:-| “[http://lists.radiantcms.org/mailman/listinfo/radiant](http://lists.radiantcms.org/mailman/listinfo/radiant)”  
\n[http://lists.radiantcms.org/mailman/listinfo/radiant](http://lists.radiantcms.org/mailman/listinfo/radiant)

–  
No virus found in this incoming message.  
Checked by AVG Free Edition.  
Version: 7.1.405 / Virus Database: 268.12.0/439 - Release Date:  
06/09/2006

–  
No virus found in this outgoing message.  
Checked by AVG Free Edition.  
Version: 7.1.405 / Virus Database: 268.12.0/439 - Release Date:  
06/09/2006