# How to restrict viewing/modifying other users data?

**URL:** <https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440>\
**Category:** Rails\
**Created:** [September 24, 2008, 10:33pm UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440 "2008-09-24T22:33:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nathan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c5a1d2/32.png) [@nathan](https://www.ruby-forum.com/u/nathan)\
**Post date:** [September 24, 2008, 10:33pm UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440/1 "2008-09-24T22:33:13Z")

</div>

Hi Everyone. I am working on my first Ruby on Rails app. It is a  
basic project management application. I have user login/logout  
functionality set up. It will only display a list of projects that  
are linked to the logged in user. However, if someone else logs in  
and types in a url such as [www.projectmanagement.com/projects/17](http://www.projectmanagement.com/projects/17)  
(where 17 is a project id), they will be able to see that project even  
if they are not linked to it. What is the best design approach to  
this problem?

Thank you for any advice!!!

Nathan

---

<div class="post-metadata">

**Author:** ![nathan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c5a1d2/32.png) [@nathan](https://www.ruby-forum.com/u/nathan)\
**Post date:** [September 24, 2008, 10:39pm UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440/2 "2008-09-24T22:39:40Z")

</div>

On Sep 24, 8:57 pm, Nathan [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi Everyone. I am working on my first Ruby on Rails app. It is a  
> basic project management application. I have user login/logout  
> functionality set up. It will only display a list of projects that  
> are linked to the logged in user. However, if someone else logs in  
> and types in a url such [aswww.projectmanagement.com/projects/17](http://aswww.projectmanagement.com/projects/17)  
> (where 17 is a project id), they will be able to see that project even  
> if they are not linked to it. What is the best design approach to  
> this problem?

Instead of doing Project.find do current\_user.projects.find  
This restricts the find to projects owned by that user.

Fred

---

<div class="post-metadata">

**Author:** ![nathan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c5a1d2/32.png) [@nathan](https://www.ruby-forum.com/u/nathan)\
**Post date:** [September 24, 2008, 10:40pm UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440/3 "2008-09-24T22:40:15Z")

</div>

I would think a simple before\_filter would work for you that would  
require a login before those projects could be viewed. Once they  
login, they would only be able to see the projects that they are  
assigned to.

Your before\_filter would be placed up top in the controller for  
projects.

Something like this…

before\_filter :login\_required, :only =\>  
[:new, :create, :edit, :update]

Then you could add all of the other actions that required a login as  
well such as :show, :add, :edit, :delete, etc., etc. I am certainly no  
Rails genius yet, but I think this would work for you.

–Cory

---

<div class="post-metadata">

**Author:** ![nathan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c5a1d2/32.png) [@nathan](https://www.ruby-forum.com/u/nathan)\
**Post date:** [September 25, 2008, 2:17am UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440/4 "2008-09-25T02:17:11Z")

</div>

Great! Thank you for the advice. I had thought of doing the  
before\_filter, but was not sure if that was the best way to go. Also,  
I like the “current\_user.projects.find” idea.

Thanks again!  
Nathan

---

<div class="post-metadata">

**Author:** ![nathan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c5a1d2/32.png) [@nathan](https://www.ruby-forum.com/u/nathan)\
**Post date:** [September 24, 2008, 10:42pm UTC](https://www.ruby-forum.com/t/how-to-restrict-viewing-modifying-other-users-data/149440/5 "2008-09-24T22:42:02Z")

</div>

Actually, nevermind. Frederick posted exactly what I was coming back  
to post!

–Cory