# Improving privacy on my app

**URL:** <https://www.ruby-forum.com/t/improving-privacy-on-my-app/180527>\
**Category:** Rails\
**Created:** [December 21, 2009, 11:20am UTC](https://www.ruby-forum.com/t/improving-privacy-on-my-app/180527 "2009-12-21T11:20:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [December 21, 2009, 11:20am UTC](https://www.ruby-forum.com/t/improving-privacy-on-my-app/180527/1 "2009-12-21T11:20:50Z")

</div>

Hi everyone,

I’m looking to get a helping hand with the following issue.

On my application, you can log in and view a friends profile. If you  
are not friends with them, you see a page called ‘stranger’ which is a  
scalled down profile page which is what ou would see until the  
friendship is confirmed.

Below is my display action which shows what’s happening:

the line ‘if( @friendship or @user.id == @logged\_in\_user.id )’ only  
seems to allow me to view my own profile, whilst now restricting the  
view of my friends to the limited view offered by the ‘strangers’  
page.

Does anyone know how to refine this so it allows me to:

- View my own profile
- View my friends profiles
- Keep displaying the ‘stranger’ page when a friendship does not yet  
exist?

Hoping someone can shed some light on this. Looked on Google for some  
time and have tried various variations of the above to get the right  
result…

Many thanks in advance.

def display  
@hide\_edit\_links = true

```
#define param - username in this case.
username = params[:username]

#Look for the user
@user = User.find_by_username(username)
@logged_in_user = User.find(session[:user_id]) #if

```

@user.logged\_in?

if @user  
@friendship = friends?( @logged\_in\_user, @user )

```
  @title = "Profile page of: #{username}"

  @info = @user.info ||= Info.new
  #@posts = Post.find_by_user_id( session[:user_id], :order =>

```

“created\_at DESC”)  
#@posts = Post.find\_by\_user\_id( @user.id, :limit =\> 1, :order =\>  
“created\_at desc”)

```
  if( @friendship or @user.id == @logged_in_user.id )

    @posts = Post.find_by_user_id( @user.id, 1, :limit =>

```

1, :conditions =\> “active\_post = 1”, :order =\> “created\_at desc”)  
respond\_to do |format|  
format.html  
end

```
  else
     render :action => "stranger"

  end

```

else  
flash[:notice] = “No user #{username} found. Please try again!”  
redirect\_to :action =\> “index”  
end  
end

–

You received this message because you are subscribed to the Google  
Groups “Ruby on Rails: Talk” group.  
To post to this group, send email to removed\_email\_address@domain.invalid.  
To unsubscribe from this group, send email to  
removed\_email\_address@domain.invalid.  
For more options, visit this group at  
[http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [December 22, 2009, 10:56am UTC](https://www.ruby-forum.com/t/improving-privacy-on-my-app/180527/2 "2009-12-22T10:56:45Z")

</div>

Hi,  
First i suggest you put logic code in model

2009/12/21 RubyonRails\_newbie [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

> #define param - username in this case.
> 
> ```
> @posts = Post.find_by_user_id( @user.id, 1, :limit =>
> flash[:notice] = "No user #{username} found. Please try again!"
> 
> ```
> 
> removed\_email\_address@domain.invalid[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> .  
> For more options, visit this group at  
> [http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).

–  
tommy xiao  
E-mail: xiaods(AT)[gmail.com](http://gmail.com)

–

You received this message because you are subscribed to the Google  
Groups “Ruby on Rails: Talk” group.  
To post to this group, send email to removed\_email\_address@domain.invalid.  
To unsubscribe from this group, send email to  
removed\_email\_address@domain.invalid.  
For more options, visit this group at  
[http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).

---

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [December 22, 2009, 9:47pm UTC](https://www.ruby-forum.com/t/improving-privacy-on-my-app/180527/3 "2009-12-22T21:47:40Z")

</div>

First guess is the problem would be somewhere in your “friends?”  
method since you can view your own profile but not anyone else’s.

On Dec 21, 5:19 am, RubyonRails\_newbie [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> ```
> username = params[:username]
> 
> respond_to do |format|
> end
> 
> ```
> 
> end

–

You received this message because you are subscribed to the Google  
Groups “Ruby on Rails: Talk” group.  
To post to this group, send email to removed\_email\_address@domain.invalid.  
To unsubscribe from this group, send email to  
removed\_email\_address@domain.invalid.  
For more options, visit this group at  
[http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en).