# Locking out users from certain records/urls

**URL:** <https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026>\
**Category:** Rails\
**Created:** [February 1, 2006, 11:42pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026 "2006-02-01T23:42:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![robbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@robbie](https://www.ruby-forum.com/u/robbie)\
**Post date:** [February 1, 2006, 11:42pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026/1 "2006-02-01T23:42:04Z")

</div>

I am using the standard login controller that ships with RoR to  
authenticate users in my application. In my app, Users belong to  
Clients, Clients have Projects that users are assigned to (stored in a  
stakeholder table with user\_id and project\_id columns) , then each  
project has a bunch of folders and assets (file uploads).

So currently I have urls that look like /project/show/12 etc. I want to  
stop users from typing in something like /project/show/24 and viewing  
projects and folders that they are not assigned to…whats the best way  
to go about this, given that a user might be assigned to projects with  
:id 12, 14, 27 etc, but perhaps not 24

(pls bear in mind I’m still a relative beginner with RoR, so verbose  
answers welcome 😉

thanks

---

<div class="post-metadata">

**Author:** ![robbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@robbie](https://www.ruby-forum.com/u/robbie)\
**Post date:** [February 1, 2006, 11:52pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026/2 "2006-02-01T23:52:39Z")

</div>

Something like

if !StakeHolder.find\_by\_user\_id\_and\_project\_id(session[:user\_id],  
params[:project\_id])

# Not yours, redirect or something.

end

in the project controller list method might work, but I am as new as  
you!!!

- Ian

On 2/1/06, robbie shepherd [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> :id 12, 14, 27 etc, but perhaps not 24  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
"Her faults were those of her race and sex; her virtues were her own.  
Farewell, and if for ever - "

– “Travels with a Donkey in the Cevennes” by Robert Louis Stevenson

---

<div class="post-metadata">

**Author:** ![robbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@robbie](https://www.ruby-forum.com/u/robbie)\
**Post date:** [February 1, 2006, 11:57pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026/3 "2006-02-01T23:57:51Z")

</div>

thanks Ian, I’ll give that a whirl…

---

<div class="post-metadata">

**Author:** ![robbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@robbie](https://www.ruby-forum.com/u/robbie)\
**Post date:** [February 2, 2006, 6:13pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026/4 "2006-02-02T18:13:31Z")

</div>

You could create User of different roles and check whether a user can  
look  
at a particular record.

For example you can

User class and Admin (which inherits User) Class. Both have permission  
classes.

When loggin in instantiate according user role ( User or Admin using  
inheritance column)

In ur permission class for User

def check\_user\_have\_access? (project)  
return project.user.id == user.id  
end

In ur Admin permission class  
def check\_user\_have\_access? (project)  
return true  
end

This way Admin will be able to see all projects and Users can see  
projects  
only they own.

–  
Rgds,  
–Siva J.  
[http://www.varcasa.com/](http://www.varcasa.com/)  
My First Rails Project.  
Education Through Collabration

---

<div class="post-metadata">

**Author:** ![robbie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/2acd7d/32.png) [@robbie](https://www.ruby-forum.com/u/robbie)\
**Post date:** [February 2, 2006, 6:58pm UTC](https://www.ruby-forum.com/t/locking-out-users-from-certain-records-urls/100026/5 "2006-02-02T18:58:58Z")

</div>

This is the ‘authorized user/unauthorized access’ problem. In many  
systems  
you have user that are authorized to use the system, but not authorized  
to  
see other users data. It can be a real challenge.

In my opinion you are asking for trouble if you rely on UI/controller  
code  
to check this for you. I think this is the equivalent of putting access  
checking into an editor to make sure that non-privileged users can’t  
edit  
‘/etc/passwd’.  
Sooner or later you or someone that follows you will miss something and  
someone will peek at someone else’s stuff. If the stuff is sensitive you  
may  
have a real problem. If it is a commercial site you may loose all your  
customers.

Instead you want to push this down below the UI. Sure you put checks in  
the  
UI - but if you miss one, you want something below to throw an  
exception.

Move that logic into your models. Make your models user aware, then  
override  
methods that you want to protect and add the user access checking there.

This is a little more work initially, but you will sleep better in the  
long  
run.

-Kelly