# Recommended way of restricting action permissions?

**URL:** <https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058>\
**Category:** Rails\
**Created:** [December 19, 2008, 9:26pm UTC](https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058 "2008-12-19T21:26:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lisa\_Klein](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/3bc359/32.png) [@Lisa\_Klein](https://www.ruby-forum.com/u/Lisa_Klein)\
**Post date:** [December 19, 2008, 9:26pm UTC](https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058/1 "2008-12-19T21:26:44Z")

</div>

Hi, I just have a “best practices” question. I’d like to block users  
that don’t own a particular resource from performing edit/update/  
destroy actions on it. Here’s how I currently do it:

## User has many resources, of different types

------- resource\_controller.rb -------

before\_filter :require\_ownership, :only =\> [:edit, :update, :destroy]

… public actions …

protected

def require\_ownership  
@resource = Resource.find(params[:id])  
redirect\_to\_somewhere unless owns?(@resource)  
end

------- application.rb -------

def owns?(resource)  
resource.user\_id == @current\_user.id  
end

… And I apply this before\_filter in the controller of any resource  
I’d like to restrict in a similar way. I’m new to Rails and MVC so  
I’m just wondering whether this is the best way of accomplishing this,  
or if a different method is recommended.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Lisa\_Klein](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/3bc359/32.png) [@Lisa\_Klein](https://www.ruby-forum.com/u/Lisa_Klein)\
**Post date:** [December 19, 2008, 9:26pm UTC](https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058/2 "2008-12-19T21:26:44Z")

</div>

Ms. Klein,

I handle that situation very similarly with the only disparity being  
where ownership is determined. In my opinion the object itself should  
know nothing about @current\_user, whereas the application can know about  
Resource.user.

I also tend to alias methods in my resources, like so

def self.owner  
self.user  
end

Then I insure that every object has some owner alias if it is to be  
restricted, and in my :require\_ownership before\_filter, I do the  
following:

def require\_ownership  
if @resource.owner == @current.user …  
end

The end effect is the same, but this allows the resource to be used  
intact in another application without modification, regardless of  
@current\_user in the other application. Just of matter of who knows  
what about whom.

Otherwise, unless someone can suggest a better method for us both, I  
personally think you’re on the right track.

Cheers,  
Darrik Mazey

Lisa Klein wrote:

> … public actions …  
> def owns?(resource)

–  
Darrik Mazey  
Developer  
DMT Programming, LLC.  
P.O. Box 91  
Torrington, CT 06790  
office: 330.983.9941  
fax: 330.983.9942  
mobile: 330.808.2025  
removed\_email\_address@domain.invalid

To obtain my public key, send an email to  
removed\_email\_address@domain.invalid.

---

<div class="post-metadata">

**Author:** ![Lisa\_Klein](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/3bc359/32.png) [@Lisa\_Klein](https://www.ruby-forum.com/u/Lisa_Klein)\
**Post date:** [December 19, 2008, 9:32pm UTC](https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058/3 "2008-12-19T21:32:02Z")

</div>

The simpler way is just search the user resources when performing an  
edit/update/delete. like this:

def edit  
@resource = @user.resources.find(params[:id])  
end

This way you can be sure that the user will not be able to select a  
resource that doesn’t belong to him.

- 

Maurício Linhares  
[http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/)  
(en)

---

<div class="post-metadata">

**Author:** ![Lisa\_Klein](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/3bc359/32.png) [@Lisa\_Klein](https://www.ruby-forum.com/u/Lisa_Klein)\
**Post date:** [December 19, 2008, 9:38pm UTC](https://www.ruby-forum.com/t/recommended-way-of-restricting-action-permissions/156058/4 "2008-12-19T21:38:30Z")

</div>

Thanks a lot for the replies! I guess I kind of prefer the  
before\_filter method a little bit because then I don’t have to  
replicate the redirect\_if\_not\_found logic in each restricted action.  
Thanks again!