# Limiting records in a restful controller

**URL:** <https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371>\
**Category:** Rails\
**Created:** [September 20, 2006, 5:13pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371 "2006-09-20T17:13:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zanoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e99b99/32.png) [@zanoni](https://www.ruby-forum.com/u/zanoni)\
**Post date:** [September 20, 2006, 5:13pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371/1 "2006-09-20T17:13:01Z")

</div>

I want to make my controller only show records for view, edit and  
destroy that belong to their owner (the user who created it).  
My question - My first guess would be to perhaps create a filter for  
the “show” action. Thus presenting the user with only their own  
records. Does this make sense ? And, is it possible for a hacker to  
send a request like ‘7;edit’ (when 7 doesn’t belong to them). So,  
perhaps I need to code all the actions for the right user ?

TIA  
Stuart

–

> **[Dark ambient](https://en.wikipedia.org/wiki/Dark_ambient)**
>
> Dark ambient (referred to as ambient industrial especially in the 1980s) is a genre of post-industrial music that features an ominous, dark droning and often gloomy, monumental or catacombal atmosphere, partially with discordant overtones. It shows similarities with ambient music, a genre that has been cited as a main influence by many dark ambient artists, both conceptually and compositionally. Although mostly electronically generated, dark ambient also includes the sampling of hand-pla 
> The te...

---

<div class="post-metadata">

**Author:** ![zanoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e99b99/32.png) [@zanoni](https://www.ruby-forum.com/u/zanoni)\
**Post date:** [September 20, 2006, 5:23pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371/2 "2006-09-20T17:23:03Z")

</div>

On 9/20/06, Dark A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> –  
> Update - I’m thinking that probably the best way to approach this is  
> via an option in the map.resources call in routes.rb. ? Maybe ?

Stuart

---

<div class="post-metadata">

**Author:** ![zanoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e99b99/32.png) [@zanoni](https://www.ruby-forum.com/u/zanoni)\
**Post date:** [September 20, 2006, 5:43pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371/3 "2006-09-20T17:43:05Z")

</div>

i use the meantime\_filter plugin to scope the active records in question. It's like having a before and after filter in one method, so you can yield a block. In the example below the require\_user method is called first and creates the @user object. Then the show action is called, but it is called within the attach\_scope method which scopes the records so only those belonging to the user are shown.  
  
class JobsController \< ApplicationController  
&nbsp;&nbsp;&nbsp; before\_filter :require\_user  
&nbsp;&nbsp;&nbsp; meantime\_filter :attach\_scope  
  
&nbsp;&nbsp;&nbsp; def show  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; @jobs.find(:all) # This will only retrieve the users jobs  
&nbsp;&nbsp;&nbsp; end  
  
private  
&nbsp;&nbsp;&nbsp; def require\_user  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; @user = User.find(params[:user])  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; if not @user or not @user.enabled; render :partial =\> "users/disabled"; return; end  
&nbsp;&nbsp;&nbsp; end  
  
&nbsp;&nbsp;&nbsp; def attach\_scope  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; Job.with\_scope(:find =\> {:conditions =\> ["user\_id = ?", @user.id]}) do  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp; yield  
&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; end  
&nbsp;&nbsp;&nbsp; end  
end  
  
  
Dark A. wrote:

> ```
> On 9/20/06, Dark A.[\<removed\_email\_address@domain.invalid\>](mailto:removed_email_address@domain.invalid)wrote:
> ```
> 
> > ```
> > I want to make my controller only show records for 
> > view, edit and
> > destroy that belong to their owner (the user who created it).
> > My question - My first guess would be to perhaps create a filter for
> > the "show" action. Thus presenting the user with only their own
> > records. Does this make sense ? And, is it possible for a hacker to
> > send a request like '7;edit' (when 7 doesn't belong to them). So,
> > perhaps I need to code all the actions for the right user ?
> > 
> > TIA  
> > Stuart
> > 
> > –
> > 
> > ```
> > </pre>
> > 
> > ```
> > ```
> 
> ```
> Update - I'm thinking that probably the best way 
> to approach this is
> via an option in the map.resources call in routes.rb. ? Maybe ?
> 
> Stuart
> ```

  

--   

&nbsp;
 A { color: blue; text-decoration: none; } A:hover { color: red; } #sig { font-family: verdana, tahoma; font-size: small; border-top: 2px solid #AAAABB; padding: 4px; color: black; }

```
#info {
	padding: 4px;
	font-family: verdana, tahoma;
	font-size: 8pt;
	color: black;
}

```

 **Jeremy W.**  
Serval Systems Ltd.
  

 [www.servalsystems.co.uk](http://www.servalsystems.co.uk)  
Tel: 01342 331940  
Fax: 01342 331950  

  
--~--~---------~--~----~------------~-------~--~----~  
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.   
 To post to this group, send email to removed\_email\_address@domain.invalid   
 To unsubscribe from this group, send email to removed\_email\_address@domain.invalid   
 For more options, visit this group at http://groups.google.com/group/rubyonrails-talk   
 -~----------~----~----~----~------~----~------~--~---

---

<div class="post-metadata">

**Author:** ![zanoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e99b99/32.png) [@zanoni](https://www.ruby-forum.com/u/zanoni)\
**Post date:** [September 20, 2006, 8:01pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371/4 "2006-09-20T20:01:25Z")

</div>

On 9/20/06, Jeremy W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> meantime_filter :attach_scope
> end
> 
> def attach_scope
> Job.with_scope(:find => {:conditions => ["user_id = ?", @user.id]})
> 
> ```
> 
> do  
> yield  
> end  
> end  
> end

This seems to be a nice solution. I received a few errors and sort of  
bailed on it for the time being, ONLY because I already have a number  
of before\_filters in the controller. I thought if I could combine the  
user.id into them it might work.

This is my before filter -

protected  
def find\_cdetail  
begin  
@cdetail = Cdetail.find(params[:id])  
rescue  
flash.now[:warning] = ‘Error, Invalid ID’  
logger.error(“RescueAttemptToFindInvalidID#{params[:id]}”)  
end  
end

and I tried doing something like this:  
protected  
def find\_cdetail  
id = params[:id]  
user = current\_user.id  
begin  
@cdetail = Cdetail.find(:all, :conditions =\>[“id = :id and  
user\_id = :user”,  
{:id =\> id, :user =\> user =\> user\_id}])  
…  
end

However it doesn’t seem to be work as expected.  
Stuart

---

<div class="post-metadata">

**Author:** ![zanoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e99b99/32.png) [@zanoni](https://www.ruby-forum.com/u/zanoni)\
**Post date:** [September 20, 2006, 7:11pm UTC](https://www.ruby-forum.com/t/limiting-records-in-a-restful-controller/69371/5 "2006-09-20T19:11:18Z")

</div>

On 2006-09-20, at 12:04 , Dark A. wrote:

> I want to make my controller only show records for view, edit and  
> destroy that belong to their owner (the user who created it).  
> My question - My first guess would be to perhaps create a filter for  
> the “show” action. Thus presenting the user with only their own  
> records. Does this make sense ? And, is it possible for a hacker to  
> send a request like ‘7;edit’ (when 7 doesn’t belong to them). So,  
> perhaps I need to code all the actions for the right user ?

Always work from the user:

@application.rb

def current\_user  
User.find(session[:user\_id])  
end

@record\_controller

def edit  
current\_user.records.find(params[:id])  
end