# Handling id for social networking site

**URL:** <https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981>\
**Category:** Rails\
**Created:** [October 27, 2009, 2:22pm UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981 "2009-10-27T14:22:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 27, 2009, 2:22pm UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/1 "2009-10-27T14:22:13Z")

</div>

Hi All,

I want to handle the id parameter for social networking site

For example:

If the user logins to the site having id=1, he can show his profile as

[http://localhost:3000/users/1](http://localhost:3000/users/1)  
[http://localhost:3000/users/1/edit](http://localhost:3000/users/1/edit) for editing

Scenario is that the logged in user having id=1 is able to see the and  
edit the profile details of another user say id=2 just by changing the  
url.

[http://localhost:3000/users/2](http://localhost:3000/users/2)  
[http://localhost:3000/users/2/edit](http://localhost:3000/users/2/edit) for editing

Continuing the same user having id=1 is also be able to copy and paste  
any url of user id=2 but some urls can only be accessed by user id=2

Problem:  
One user must not able to access another user details, Please let me  
know how to handle url parameters.

Thanks in advance,  
Saurabh

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 27, 2009, 2:43pm UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/2 "2009-10-27T14:43:20Z")

</div>

Saurabh P. wrote:

> Hi All,
> 
> I want to handle the id parameter for social networking site
> 
> For example:
> 
> If the user logins to the site having id=1, he can show his profile as
> 
> [http://localhost:3000/users/1](http://localhost:3000/users/1)  
> [http://localhost:3000/users/1/edit](http://localhost:3000/users/1/edit) for editing
> 
> Scenario is that the logged in user having id=1 is able to see the and  
> edit the profile details of another user say id=2 just by changing the  
> url.
> 
> [http://localhost:3000/users/2](http://localhost:3000/users/2)  
> [http://localhost:3000/users/2/edit](http://localhost:3000/users/2/edit) for editing
> 
> Continuing the same user having id=1 is also be able to copy and paste  
> any url of user id=2 but some urls can only be accessed by user id=2
> 
> Problem:  
> One user must not able to access another user details, Please let me  
> know how to handle url parameters.
> 
> Thanks in advance,  
> Saurabh

Assuming you have a current\_user method, or something similar-

#in users controller  
before\_filter :user\_is\_current\_user

def user\_is\_current\_user  
redirect\_to :action =\> “index” unless current\_user.id ==  
params[:id].to\_i  
end

Something like that anyway. This will make it so that a user can only  
be edited, created, updated or viewed by themselves. If you wanted to  
change it so that admin users could edit others details you could change  
it like

def user\_is\_current\_user  
redirect\_to :action =\> “index” unless current\_user.admin? ||  
current\_user.id == params[:id].to\_i  
end

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 27, 2009, 3:39pm UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/3 "2009-10-27T15:39:47Z")

</div>

Thanks Max,

Do you have any idea about url hiding

Example:

My current url: [http://localhost:3000/users/buying\_history](http://localhost:3000/users/buying_history)

I want to display it as [http://localhost:3000/#](http://localhost:3000/#) or uneditable

Thanks  
Saurabh

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 27, 2009, 3:46pm UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/4 "2009-10-27T15:46:56Z")

</div>

Saurabh P. wrote:

> Thanks Max,
> 
> Do you have any idea about url hiding
> 
> Example:
> 
> My current url: [http://localhost:3000/users/buying\_history](http://localhost:3000/users/buying_history)
> 
> I want to display it as [http://localhost:3000/#](http://localhost:3000/#) or uneditable
> 
> Thanks  
> Saurabh

I don’t know how you could do this, best post in a new thread i think,  
since it’s a different question.

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 28, 2009, 2:58am UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/5 "2009-10-28T02:58:27Z")

</div>

why? make sure users know where they are~~

url trickery is not a smart way~

On Oct 27, 10:39 pm, Saurabh P. \<rails-mailing-l…@andreas-

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 28, 2009, 10:35am UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/6 "2009-10-28T10:35:27Z")

</div>

> #in users controller  
> before\_filter :user\_is\_current\_user
> 
> def user\_is\_current\_user  
> redirect\_to :action =\> “index” unless current\_user.id ==  
> params[:id].to\_i  
> end

Actually, a correction, i just noticed that i made this redirect to  
somewhere that is blocked, so it will go into an infinite loop. Just  
change the redirect to somewhere people can get to, like the home page  
for example.

def user\_is\_current\_user  
redirect\_to “/” unless current\_user.id == params[:id].to\_i

---

<div class="post-metadata">

**Author:** ![saurabhpurnaye](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ee59a6/32.png) [@saurabhpurnaye](https://www.ruby-forum.com/u/saurabhpurnaye)\
**Post date:** [October 28, 2009, 2:20am UTC](https://www.ruby-forum.com/t/handling-id-for-social-networking-site/177981/7 "2009-10-28T02:20:23Z")

</div>

On Oct 27, 10:39 am, Saurabh P. \<rails-mailing-l…@andreas-  
[s.net](http://s.net)\> wrote:

> Thanks Max,
> 
> Do you have any idea about url hiding
> 
> Example:
> 
> My current url:[http://localhost:3000/users/buying\_history](http://localhost:3000/users/buying_history)
> 
> I want to display it ashttp://localhost:3000/#or uneditable

Don’t do this. You’re going to have to put the path someplace, and  
sufficiently determined attackers will mess with that place, wherever  
it is. The better approach is to design your app so that users can’t  
do things they aren’t supposed to, URL-trickery aside.

–Matt J.