# Problems with acl\_system and before\_filter

**URL:** <https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708>\
**Category:** Rails\
**Created:** [November 7, 2006, 10:53am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708 "2006-11-07T10:53:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [November 7, 2006, 10:53am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708/1 "2006-11-07T10:53:18Z")

</div>

i am using the acl\_system plugin but am having problems when users try  
to access restricted pages before they are logged in.

i have my before\_filter :check\_authentication before the access\_control  
line, but everytime i try to access a page without being logged in, i  
get an error saying:

Couldn’t find User without an ID

/usr/local/lib/ruby/gems/1.8/gems/activerecord-1.14.4/lib/active\_record/base.rb:939:in  
`find_from_ids' /usr/local/lib/ruby/gems/1.8/gems/activerecord-1.14.4/lib/active_record/base.rb:382:in`find’  
#{RAILS\_ROOT}/app/controllers/application.rb:15:in `current\_user’

nothing should be accessing my current\_user method before the user is  
logged in, and this all worked until i added the acl line right after  
it.

is this a bug or did i do something wrong?

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [November 7, 2006, 10:53am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708/2 "2006-11-07T10:53:33Z")

</div>

On Nov 1, 2006, at 2:54 PM, Josh wrote:

> it.
> 
> is this a bug or did i do something wrong?

```
Well the acl_system plugin does its thing based on the current_user

```

method. SO you really should only be using the access\_control for  
pages that you are sure the users will be logged in for. The login  
action has to set the current\_user for access\_control to work. Can  
you paste your controller code? I can help make it work.

Cheers-

– Ezra Z.  
– Lead Rails Evangelist  
– removed\_email\_address@domain.invalid  
– Engine Y., Serious Rails Hosting  
– (866) 518-YARD (9273)

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [November 7, 2006, 10:54am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708/3 "2006-11-07T10:54:55Z")

</div>

Here is some code from my Tasks controller and my application.rb file:

class TasksController \< ApplicationController

layout ‘standard’

before\_filter :check\_authentication

access\_control :DEFAULT =\> ‘POD’,  
[:sort, :update\_position] =\> ‘(admin & POD)’

… controller methods …  
end

class ApplicationController \< ActionController::Base

def check\_authentication  
unless session[:user\_id]  
session[:original\_uri] = request.request\_uri  
flash[:notice] = ‘Please log in’  
redirect\_to :controller =\> ‘account’, :action =\> ‘login’  
end  
end

helper\_method :current\_user  
def current\_user  
@current\_user ||= User.find(session[:user\_id])  
end  
end

Thanks for the help

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [November 7, 2006, 10:54am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708/4 "2006-11-07T10:54:31Z")

</div>

hi ezra!

Ezra Z. [02.11.2006 01:14]:

> Well the acl\_system plugin does its thing based on the  
> current\_user method. SO you really should only be using the  
> access\_control for pages that you are sure the users will be  
> logged in for. The login action has to set the current\_user for  
> access\_control to work.  
> sure, but when i ran across that very same problem, i decided that  
> acl\_system should simply allow access if the user hasn’t been logged  
> in yet:

---- snip ----  
module Caboose::LogicParser  
alias :original\_process :process

def process(logicstring, context)  
context[:user].nil? or original\_process(logicstring, context)  
end  
end  
---- snip ----

otherwise i wouldn’t be able to protect my login controller (which  
actually is an account controller) by acl\_system.

cheers  
jens

–  
Jens W., Dipl.-Bibl. (FH)  
prometheus - Das verteilte digitale Bildarchiv für Forschung & Lehre  
An St. Laurentius 4, 50931  
KölnTel.: +49 (0)221 470-6668, E-Mail: removed\_email\_address@domain.invalid  
[http://www.prometheus-bildarchiv.de/](http://www.prometheus-bildarchiv.de/)

---

<div class="post-metadata">

**Author:** ![jjkiesch](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jjkiesch](https://www.ruby-forum.com/u/jjkiesch)\
**Post date:** [November 7, 2006, 10:54am UTC](https://www.ruby-forum.com/t/problems-with-acl-system-and-before-filter/74708/5 "2006-11-07T10:54:57Z")

</div>

I ran into this problem because i have emails sent out with links to  
certain tasks, but it requires login in order to view them.

i store the intended url in a session variable and then redirect them  
to that page once they are logged in so that they don’t have to dig  
through all of the tasks to find the one they were looking for.