# Rails security help

**URL:** <https://www.ruby-forum.com/t/rails-security-help/177292>\
**Category:** Rails\
**Created:** [October 14, 2009, 4:42pm UTC](https://www.ruby-forum.com/t/rails-security-help/177292 "2009-10-14T16:42:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marli03](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@marli03](https://www.ruby-forum.com/u/marli03)\
**Post date:** [October 14, 2009, 4:42pm UTC](https://www.ruby-forum.com/t/rails-security-help/177292/1 "2009-10-14T16:42:00Z")

</div>

Hey I was wondering if anyone knows of a gem or plugin that can limit  
fields returned based on the User’s role? I’m looking for something  
that will basically rewrite the find() method to limit the fields  
returned based on the User role.

so,

Admin:  
Product.all =\> returns id, number, description, cost fields

Guest:  
Product.all =\> returns id, number, description fields

Thanks!

---

<div class="post-metadata">

**Author:** ![marli03](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@marli03](https://www.ruby-forum.com/u/marli03)\
**Post date:** [October 15, 2009, 3:11am UTC](https://www.ruby-forum.com/t/rails-security-help/177292/2 "2009-10-15T03:11:25Z")

</div>

Marli Ba wrote:

> Hey I was wondering if anyone knows of a gem or plugin that can limit  
> fields returned based on the User’s role? I’m looking for something  
> that will basically rewrite the find() method to limit the fields  
> returned based on the User role.
> 
> so,
> 
> Admin:  
> Product.all =\> returns id, number, description, cost fields
> 
> Guest:  
> Product.all =\> returns id, number, description fields
> 
> Thanks!

We use something similar to filter objects in zena  
([zena/lib/zena/acts/secure.rb at master · zena/zena · GitHub](http://bit.ly/2yjaVk)). Basically, you need two things:

1. the visitor pattern (stored in Thread.current)
2. scoped finders

I wrote an exemple of what you could use to filter fields:

> <https://gist.github.com/anna-bucher/210544>

To store the visitor in the Thread, the simplest solution is:

unless Thread.current.respond\_to?(:visitor)  
class \<\< Thread.current  
attr\_accessor :visitor  
end  
end  
Thread.current.visitor = logged\_in\_user

Gaspard

---

<div class="post-metadata">

**Author:** ![marli03](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@marli03](https://www.ruby-forum.com/u/marli03)\
**Post date:** [October 15, 2009, 4:51pm UTC](https://www.ruby-forum.com/t/rails-security-help/177292/3 "2009-10-15T16:51:22Z")

</div>

Gaspard B. wrote:

> We use something similar to filter objects in zena  
> ([zena/lib/zena/acts/secure.rb at master · zena/zena · GitHub](http://bit.ly/2yjaVk)). Basically, you need two things:
> 
> 1. the visitor pattern (stored in Thread.current)
> 2. scoped finders
> 
> I wrote an exemple of what you could use to filter fields:  
> [gist:210544 · GitHub](http://gist.github.com/210544)
> 
> To store the visitor in the Thread, the simplest solution is:
> 
> unless Thread.current.respond\_to?(:visitor)  
> class \<\< Thread.current  
> attr\_accessor :visitor  
> end  
> end  
> Thread.current.visitor = logged\_in\_user
> 
> Gaspard

Thanks! I’ve been looking through the code and like what I see. I think  
I may end up with my own unique implementation, but it’s helpful to see  
how others have done things.

---

<div class="post-metadata">

**Author:** ![marli03](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/59ef9b/32.png) [@marli03](https://www.ruby-forum.com/u/marli03)\
**Post date:** [October 22, 2009, 4:41pm UTC](https://www.ruby-forum.com/t/rails-security-help/177292/4 "2009-10-22T16:41:45Z")

</div>

Gaspard, I noticed your program uses scopes to limit the returned  
information. I’m running rails 2.3.4 and there seems to be an issue  
with scopes and HABTM relationships: that they don’t carry through.

I’ve tried using named scopes in my Product class like this:

class Product \< ActiveRecord::Base  
has\_and\_belongs\_to\_many :categories  
named\_scope :with\_fields\_for\_role, lambda {|role| {:select =\> **code  
to only select certain columns based on role** } }  
end

class Category \< ActiveRecord::Base  
has\_and\_belongs\_to\_many :products  
end

Console:

> > Product.with\_fields\_for\_role(:guest).first  
> > =\> \<Product id: 1, number: “000-010”, manufacturer\_id: 12,  
> > manufacturer\_number: “”, status: “Current”, description: “PURCHASE ORDER  
> > FORMS:”, extended\_information: nil\>
> 
> > Category.first.products.with\_fields\_for\_role(:guest).first  
> > =\> ## returns all columns of the product

The first statement works perfectly and the second does not. There  
already is a bug report about this.

Have you noticed any problems with your program with this issue?