# Is this safe?

**URL:** <https://www.ruby-forum.com/t/is-this-safe/133032>\
**Category:** Rails\
**Created:** [March 26, 2008, 10:12pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032 "2008-03-26T22:12:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [March 26, 2008, 10:12pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032/1 "2008-03-26T22:12:48Z")

</div>

I am using an eval so I dont have to check avery case of a permission.

def folder\_permission(folder\_id, per)  
permissions =  
self.user\_folder\_permissions.find\_by\_folder\_id(folder\_id)  
return true unless permissions.blank? or not  
eval(“permissions.”+per)  
return false  
end

This function is called from private method in file controller.

def authorize\_creating  
unless  
session[:user].folder\_permision(params[:folder\_id],“can\_create”)  
flash.now[:folder\_error] = “You don’t have create permissions for  
this  
folder.”  
redirect\_to :controller =\> ‘file’, :action =\> ‘error’ and return  
false  
end  
end

So am I safe to use this, is this efficient for ruby?

thanks

PAco

---

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [March 26, 2008, 10:16pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032/2 "2008-03-26T22:16:54Z")

</div>

On Mar 26, 9:11 pm, “Paco Viramontes” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I am using an eval so I dont have to check avery case of a permission.
> 
> def folder\_permission(folder\_id, per)  
> permissions = self.user\_folder\_permissions.find\_by\_folder\_id(folder\_id)  
> return true unless permissions.blank? or not eval(“permissions.”+per)  
> return false  
> end

I’d just write permissions.send(per) rather than use the eval. I don’t  
think you’re opening yourself up to anything super bad, but it seems  
like a big sledgehammer being used for a rather small nut.

Fred

---

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [March 26, 2008, 10:59pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032/3 "2008-03-26T22:59:26Z")

</div>

On Mar 26, 2008, at 5:16 PM, Frederick C. wrote:

> > end
> 
> I’d just write permissions.send(per) rather than use the eval. I don’t  
> think you’re opening yourself up to anything super bad, but it seems  
> like a big sledgehammer being used for a rather small nut.
> 
> Fred

Go with .send(per), but doesn’t the structure of that hurt your head?!

def folder\_permission(folder\_id, per)  
if permission =  
self.user\_folder\_permissions.find\_by\_folder\_id(folder\_id)  
permission.send(per) rescue false  
else  
false  
end  
end

Having that “unless A or not B” in there has got to be confusing (or  
it will be a month from now).

-Rob

Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [March 28, 2008, 1:24pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032/4 "2008-03-28T13:24:36Z")

</div>

On Wed, Mar 26, 2008 at 5:58 PM, Rob B.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > > eval(“permissions.”+per)  
> > > Go with .send(per), but doesn’t the structure of that hurt your head?!  
> > > end
> 
> Having that “unless A or not B” in there has got to be confusing (or  
> it will be a month from now).

I’d consider a more radical refactoring (all untested of course):

in the models (I’m assuming the folder\_permission method is in the  
User model based on the controller code, and there’s a Permissions  
model):

class Permissions \< ActiveRecord::Base

class NoPermissions \< Permissions  
def can\_not  
false  
end  
[:can\_create, :can\_read, :can\_write].each {|meth|  
alias\_method(meth, :can\_not)}  
end

def Permissions.none  
@no\_permissions ||= NoPermissions.new  
end  
end

class User \< ActiveRecord::Base

def permissions\_for\_folder(folder\_id)  
user\_folder\_permissions.find\_by\_folder\_id(folder\_id) ||  
Permissions.none  
end

And the controller method becomes:

def authorize\_creating  
unless session[:user].  
permissions\_for\_folder(params[:folder\_id]).can\_create)  
flash.now[:folder\_error] = “You don’t have create permissions  
for this folder.”  
redirect\_to :controller =\> ‘file’, :action =\> ‘error’ and return  
false  
end  
end

I might also think about renaming the can\_xx methods to something like  
allows\_xxx? or permits\_xxx? which would read a bit better I think.

–  
Rick DeNatale

My blog on Ruby  
[http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/)

---

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [April 2, 2008, 1:54am UTC](https://www.ruby-forum.com/t/is-this-safe/133032/5 "2008-04-02T01:54:47Z")

</div>

On Apr 1, 1:49 pm, “Paco Viramontes” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> # user\_id :integer(11) default(0)
> 
> * * *
> 
> Also if the permissions\_for\_folder receives folder\_id why do you call it  
> like this?  
> permissions\_for\_folder(params[:folder\_id]).can\_create)

Because params[:folder\_id] contains the folder\_id ?

Given your schema above, it does seem like you want to use Rick’s  
approach of 1) get the permissions object, 2) ask it about the  
particular permission

permission\_for(…).can\_create?

What’s the point in having those methods if you’re going to bend over  
backwards to call them via eval or send? You may want to consider  
caching the retrieved permission object also.

---

<div class="post-metadata">

**Author:** ![Paco\_Viramontes](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/94ad74/32.png) [@Paco\_Viramontes](https://www.ruby-forum.com/u/Paco_Viramontes)\
**Post date:** [April 1, 2008, 7:50pm UTC](https://www.ruby-forum.com/t/is-this-safe/133032/6 "2008-04-01T19:50:05Z")

</div>

## Ok, thanks I like your aproach Rick but I dont quite get what your are doung there in the permissions model. My model actually looks like this:

# == Schema Information

# Schema version: 21

# 

# Table name: user\_folder\_permissions

# 

# id :integer(11) not null, primary key

# folder\_id :integer(11) default(0)

# user\_id :integer(11) default(0)

# can\_create :boolean(1)

# can\_read :boolean(1)

# can\_update :boolean(1)

# can\_delete :boolean(1)

# 

class UserFolderPermission \< ActiveRecord::Base  
belongs\_to :user  
belongs\_to :folder  
end

* * *

Also if the permissions\_for\_folder receives folder\_id why do you call it  
like this?  
permissions\_for\_folder(params[:folder\_id]).can\_create)

On Fri, Mar 28, 2008 at 6:23 AM, Rick DeNatale [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)