# How to hide non permited actions?

**URL:** <https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621>\
**Category:** Rails\
**Created:** [October 25, 2006, 7:28pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621 "2006-10-25T19:28:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ana](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://www.ruby-forum.com/u/ana)\
**Post date:** [October 25, 2006, 7:28pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621/1 "2006-10-25T19:28:45Z")

</div>

Im showing in the view a menu with just the options to certain user, ie:

\<% if user = “admin” %\>  
\<a href"/action/addcontent"\>Add content  
\<% end %\>

and that works but if the user goes and directly writes in the address  
bar myappurl/action/adcontent/TheContent that is valid and the rails app  
processes it.

How i can avoid this? i mean, remome access to certain actions of the  
rails app completely.

---

<div class="post-metadata">

**Author:** ![ana](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://www.ruby-forum.com/u/ana)\
**Post date:** [October 25, 2006, 7:50pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621/2 "2006-10-25T19:50:22Z")

</div>

Check out before\_filter. This allows you to call a method (or Proc) to  
determine whether the code should continue running.

class MyController  
before\_filter :authenticate

def authenticate  
# is ok? return true else return false  
end  
end

Also, check out the LoginEngine  
([http://api.rails-engines.org/login\_engine/](http://api.rails-engines.org/login_engine/)),  
a very comprehensive user authentication tool for Rails. Even if it’s  
too  
much for your app, it still has a lot of good ideas in it on how to do  
just  
this.

Jason

---

<div class="post-metadata">

**Author:** ![ana](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://www.ruby-forum.com/u/ana)\
**Post date:** [October 25, 2006, 7:56pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621/3 "2006-10-25T19:56:22Z")

</div>

Hi Ana,

Ana wrote:

> if the user goes and directly writes in the address  
> bar myappurl/action/adcontent/TheContent that is  
> valid and the rails app processes it.
> 
> How i can avoid this? i mean, remome access to  
> certain actions of the rails app completely.

Put a line

protected

in your controller.

Then put any controller methods that you don’t want to be available via  
user  
entered URL’s beneath that line. Anything below the ‘protected’ line  
can  
only be invoked from other methods in your app.

hth,  
Bill

---

<div class="post-metadata">

**Author:** ![ana](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://www.ruby-forum.com/u/ana)\
**Post date:** [October 25, 2006, 8:00pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621/4 "2006-10-25T20:00:23Z")

</div>

_class HomeController \< ApplicationController_  
\*\*

- before\_filter :verify\_admin\_user\*

def verify\_admin\_user  
user = session[:user\_id}  
user = User.find(user) if user  
unless user && user.is\_admin?  
redirect\_to :controller =\> ‘home’, :action =\> ‘index’  
end  
end

You need to define your is\_admin method in your User model class.

How i can avoid this? i mean, remome access to certain actions of the

---

<div class="post-metadata">

**Author:** ![ana](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://www.ruby-forum.com/u/ana)\
**Post date:** [October 25, 2006, 7:58pm UTC](https://www.ruby-forum.com/t/how-to-hide-non-permited-actions/73621/5 "2006-10-25T19:58:23Z")

</div>

> Im showing in the view a menu with just the options to certain user, ie:
> 
> \<% if user = “admin” %\>  
> \<a href"/action/addcontent"\>Add content  
> \<% end %\>

Hope you meant “==” cause the above will always be true as it’s  
assigning  
“admin” to the user variable… so everyone is going to see that link.