# How to do security?

**URL:** <https://www.ruby-forum.com/t/how-to-do-security/50648>\
**Category:** Rails\
**Created:** [December 19, 2005, 5:51pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648 "2005-12-19T17:51:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 19, 2005, 5:51pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/1 "2005-12-19T17:51:03Z")

</div>

hey, i have maded some security in my website based on  
[http://www.chaconforcongress.com/accounts/login](http://www.chaconforcongress.com/accounts/login)

Here they work with users, roles and persmission, and they check it like  
this,  
user.has\_permission(permission).

I have extended this to: users and groups with roles and permissions.  
With permissions like “view records”,“edit records”,“delete records”,…

def has\_permission(permission)  
@permissions = Hash.new(false)  
for group in self.groups  
for role in group.roles  
for perm in role.permissions  
if perm.name == permission  
return true  
end  
end  
end  
end  
false  
end

All this works good. But all this security is based on the type of role  
the user  
has (what actions the user may do)

But now i want also security on “what” the user may see.

i have in my database ex. clients ids =\> 1 , 2, 3, 4 and 5  
User 1 may only see id 1, 2 and 3  
User 2 may only see id 2, 4 and 5  
User 3 may only see id 3 and 5  
…etc

anyone has a idea who to do this???  
in this example there are 5 ids, but that can be easily 1000+

Thanks in advance  
Nick

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 19, 2005, 6:18pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/2 "2005-12-19T18:18:07Z")

</div>

you many want to implement this via associations

setup a join table clients\_users and a habtm relationship between  
clients  
and users.

then only allow user X to view their associated clients.

(untested)

class ClientController \< ApplicationController  
def list  
# only list current user’s clients  
@clients = @session[:user].clients  
end

def show  
try  
# limit find to only those clients that are associated with  
current  
user  
# will raise a RecordNotFound exception if not found  
@client = @session[:user].clients.find(params[:id])  
rescue RecordNotFound  
flash[:error] = “you don’t have access to view that client”  
render :action =\> :list  
end  
end  
end

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 20, 2005, 2:57pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/3 "2005-12-20T14:57:21Z")

</div>

hey,

thanks for that, i was also thinking of that.

But if u have this situation:

Database has 1000 clients  
User X may watch 1 to 500  
Then u have 500 records in clients\_users

Wont that affect the performence of my site ??

If anyone has any other suggestions, also welcome…

Thx  
Nick

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 20, 2005, 3:33pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/4 "2005-12-20T15:33:29Z")

</div>

depends on your queries, however querying for 500 records shouldn’t be a  
big  
performance hit, you can always populate some data and see how long the  
queries are taking to execute.

On 12/20/05, Brutyn N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
Steven R.  
web application & interface developer  
[http://www.zerium.com](http://www.zerium.com)  
[phone] 404-488-4364

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 20, 2005, 5:40pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/5 "2005-12-20T17:40:01Z")

</div>

same thing, different way

class ClientController \< ApplicationController  
def list  
# only list current user’s clients  
@clients = @session[:user].clients  
end

def show  
try  
# load the client  
@client = Client.find(@params[:id])

```
  # check if user is associated with the client
  if @client.users.include?(@session[:user])
    # user is associated
  else
    # user is not associated
    flash[:notice] = "user not associated with this client"
    redirect_to :action => :list
  end
 rescue RecordNotFound
  flash[:error] = "Cannot find client!!!"
  redirect_to :action => :list
end

```

end  
end

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 21, 2005, 12:18pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/6 "2005-12-21T12:18:08Z")

</div>

hey,

i’m trying to implement this stuff.

user x can acces client 1, client 2, client 4

i want this on my site, 2 list, one with the available clients, and the  
other  
with the clients the user can access  
(i know this i more javascript, but does anyone has a great script for  
this, i  
found one but it isnt that good, some bugs i can find)

Select the clients that the user may access.  
Available clients Selected clients  
client 3 \>\> client 1  
client 5 client 2  
client 6 \<\< client 4  
client 7

---

<div class="post-metadata">

**Author:** ![Brutyn\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@Brutyn\_N](https://www.ruby-forum.com/u/Brutyn_N)\
**Post date:** [December 22, 2005, 2:41pm UTC](https://www.ruby-forum.com/t/how-to-do-security/50648/7 "2005-12-22T14:41:43Z")

</div>

Hey,

i want to extend this security stuff

this is the situation:  
User x can access all user or several user (ex user1, user 2, user 3)  
In the client tab, u can search on clients and the query result is  
display under  
the search with pagination.

Now u can have 2 things:  
-user may access all clients, displays all clients, search on name  
brutyn, and  
display the clients (normal situation)  
-user may access user1, 2 and 3, displays those clients, search on  
user1, and  
now need to display user1 ( i need help for this =\> several clients +  
search +  
pagination)

this is in my controller

def list  
#setting the charset to utf8 for displaying the wierd characters on the  
page  
output\_to\_html  
#getting the firm id from the session  
user = User.find(@session[:user].id)  
@firm\_id = @session[:user].firm\_id  
#checking if there is a post  
if @request.post?  
@name = params[:client][:name].blank? ? ‘’ : params[:client][:name]  
@address1 = params[:client][:address1].blank? ? ‘’  
:params[:client][:address1]  
@zip = params[:client][:zip].blank? ? ‘’ : params[:client][:zip]  
@city = params[:client][:city].blank? ? ‘’ : params[:client][:city]  
@country = params[:client][:country].blank? ? ‘’ :  
:params[:client][:country]  
end

#getting the clients records depending on the given paramaters and  
paginate it  
@client\_pages, @clients = paginate :client, :conditions =\> [‘firm\_id = ?  
and  
name like ? and address1 like ? and zip like ? and city like ? and  
country like  
? and deleted like ?’, @firm\_id, “%#{@name}%”, “%#{@address1}%”,  
“%#{@zip}%”,  
“%#{@city}%”, “%#{@country}%”,0] , :order\_by =\> “name ASC”, :per\_page =\>  
10

if user.has\_permission(‘admin’) || user.view\_all == 1  
else  
# only list current user’s clients  
for client in user.clients  
…check if user may be access, and is in the searched items  
end  
end

end