# Sessions

**URL:** <https://www.ruby-forum.com/t/sessions/181807>\
**Category:** Rails\
**Created:** [January 18, 2010, 4:46pm UTC](https://www.ruby-forum.com/t/sessions/181807 "2010-01-18T16:46:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dwdw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b5e925/32.png) [@dwdw](https://www.ruby-forum.com/u/dwdw)\
**Post date:** [January 18, 2010, 4:46pm UTC](https://www.ruby-forum.com/t/sessions/181807/1 "2010-01-18T16:46:13Z")

</div>

Hello, I have a little question.

I want to an user edit or delete their comments. For it, I have this  
code:

\<% if post.usuario\_id == session[:usuario\_id] %\>

\<%= link\_to ‘Editar’, {:action =\> ‘edit’, :id =\> post.id}  
%\>  
\<% end %\>

You can see that post have a value “usuario\_id” where the I must  
completed manually in the new post form. I want to change it and compare  
the name of the commenter:

\<% if post.nombre == session[:usuario\_nombre] %\>

And my code of login:

def login  
if request.post?  
usuario = Usuario.authenticate(params[:nombre],  
params[:password])  
if usuario  
#Here, I changed usuario.id to usuario.nombre to store the name’s user  
in the session, right?  
#session[:usuario\_nombre] = usuario.nombre  
session[:usuario\_id] = usuario.id  
redirect\_to(:action =\> “index”)  
else  
flash.now[:notice] = “Usuario o contraseña no válido”  
end  
end  
end

I thought that it could work, but not… I have modified the if sentence  
and the admin\_controller and I see that it works for a moment! I logged  
out to try with other user and I received an error. I think that, when  
it works, I have this:

\<% if post.nombre == session[:usuario\_nombre].nombre %\>

And I received this error, I think:

“undefined method `nombre’ for 1:Fixnum”

I’m surely that the problem is in the if sentence and/or  
admin\_controller, in session[:param] = …

---

<div class="post-metadata">

**Author:** ![dwdw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b5e925/32.png) [@dwdw](https://www.ruby-forum.com/u/dwdw)\
**Post date:** [January 18, 2010, 11:09pm UTC](https://www.ruby-forum.com/t/sessions/181807/2 "2010-01-18T23:09:06Z")

</div>

Hi Jorge,

First of all, you mention that you have to give usuario\_id manually  
every time you create a post. This doesn’t sound right at all to me.  
Do you create a post from the name of a user who is currently logged  
in? If so, you have his usuario\_id in the session, don’t you? In the  
post#create action you create a new model instance from form  
parameters and set the post.usuario\_id to session[:usuario\_id].  
Moreover, if you use one of the standard authentication plugins, you  
will have “current\_user” available to almost any piece of the  
application (controllers, views, helpers), and so you can get your  
user ID from that.

Your check then becomes:

own\_post = logged\_in? && current\_user.id == post.usuario\_id

To push it a bit further, you may want to move this piece into the  
application helper, like this:

def owns?(resource)  
logged\_in? && current\_user.id == resource.usuario\_id  
end

And then your view becomes:

\<% if owns?(post) %\>

\<%= link\_to ‘Editar’, {:action =\> ‘edit’, :id =\> post.id}  
%\>  
\<% end %\>

I didn’t go far to the analysis of your error since the solution  
doesn’t sound right in the first place.

Hope it helps.

- Aleksey