# Help with Access Control

**URL:** <https://www.ruby-forum.com/t/help-with-access-control/144781>\
**Category:** Rails\
**Created:** [August 1, 2008, 11:46pm UTC](https://www.ruby-forum.com/t/help-with-access-control/144781 "2008-08-01T23:46:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Apprentice321](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/73ab20/32.png) [@Apprentice321](https://www.ruby-forum.com/u/Apprentice321)\
**Post date:** [August 1, 2008, 11:46pm UTC](https://www.ruby-forum.com/t/help-with-access-control/144781/1 "2008-08-01T23:46:00Z")

</div>

Hi,

I am following the excellent tutorial  
[http://www.railsforum.com/viewtopic.php?id=14216](http://www.railsforum.com/viewtopic.php?id=14216)  
(post 5) on how to implement an access control feature i.e. only a  
friend is allowed to view a profile of a particular member. I am not  
using the restful authentication plugin as the author is using to  
implement the authentication feature (post 1) in the tutorial. All I  
am interested in is the post 5 where the author explains how to  
implement access control. I have created the friends table and  
followed post 5 step by step, unfortunately I am getting the following  
error when I try to attempt to run the “show” method. Some tips will  
really be helpful, many thanks in advance

error: stack level too deep  
usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active\_record/  
reflection.rb:219:in `derive_class_name' /usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active_record/ reflection.rb:106:in `class\_name’  
/usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active\_record/  
reflection.rb:129:in `klass' /usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active_record/ reflection.rb:189:in `source\_reflection’  
/usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active\_record/  
reflection.rb:189:in `collect' /usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active_record/ reflection.rb:189:in `source\_reflection’  
…  
/usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active\_record/  
associations.rb:1128:in `new' /usr/lib/ruby/gems/1.8/gems/activerecord-2.1.0/lib/active_record/ associations.rb:1128:in `pals’  
app/models/user.rb:17:in `has_pal?' app/controllers/users_controller.rb:20:in `show’

/models/user.rb

line 16: def has\_pal?(pal)  
line 17: self.pals.find(pal) ? true : false  
Line 18: end

/controllers/users\_controller.rb

Line 18: def show  
Line 19: @info = User.find(params[:id])  
Line 20: unless current\_user.has\_pal?(@info)  
Line 21: redirect\_to :controller =\> “users”, :action =\> “index”  
Line 22: end  
Line 23: end

here is the full contents of the user model

require ‘digest/sha1’  
class User \< ActiveRecord::Base  
has\_many :pals  
has\_many :pals, :through =\> :pals

# attr\_accessor :password

validates\_presence\_of :username  
validates\_presence\_of :password  
validates\_presence\_of :password\_confirmation  
validates\_length\_of :password, :within =\> 4…40  
validates\_confirmation\_of :password  
validates\_length\_of :username, :within =\> 3…40  
validates\_length\_of :email, :within =\> 3…100  
validates\_uniqueness\_of :username, :email, :case\_sensitive =\>  
false

```
def has_pal?(pal)

```

# self.pals.find(pal) ? true : false

end

#validate

# errors.add\_to\_base(“No password”) if crypted\_password.blank?

# end

# Authenticates a user by their username name and unencrypted

password. Returns the user or nil.  
def self.authenticate(username, crypted\_password)  
login = find\_by\_username(username) # need to get the salt  
if login  
expected\_password = encrypted\_password(crypted\_password,  
login.salt)  
if login.crypted\_password != expected\_password  
login = nil  
end  
end  
login  
end

def password  
@password  
end  
def password=(pw)  
@password = pw  
create\_new\_salt  
self.crypted\_password = User.encrypted\_password(self.password,  
self.salt)  
end

def remember\_token?  
remember\_token\_expires\_at && Time.now.utc \<  
remember\_token\_expires\_at  
end

# These create and unset the fields required for remembering users

between browser closes  
def remember\_me  
self.remember\_token\_expires\_at = 2.weeks.from\_now.utc  
self.remember\_token = encrypt(“#{email}–  
#{remember\_token\_expires\_at}”)  
save(false)  
end

def forget\_me  
self.remember\_token\_expires\_at = nil  
self.remember\_token = nil  
save(false)  
end

private  
# before filter  
def self.encrypted\_password(password, salt)  
string\_to\_hash = “#{password}wibble”+ salt  
Digest::SHA1.hexdigest(string\_to\_hash)  
end

```
def create_new_salt
  self.salt = self.object_id.to_s + rand.to_s

```

end  
end