# "show" action - restrict manual url change from user to view

**URL:** <https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843>\
**Category:** Rails\
**Created:** [June 29, 2010, 4:36am UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843 "2010-06-29T04:36:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [June 29, 2010, 4:36am UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/1 "2010-06-29T04:36:57Z")

</div>

This is “show” action in my “category controller”.

#---- Show —  
def show  
# @category=Category.find(params[:category\_id])  
@category=Category.find(params[:category\_id])  
end

“show” action - restrict manual url change from user to view the  
inactive records. "  
Active/inactive are set via status column in category table.  
where status=‘A’

since the url shows up in the url bar, the user can simply type in a  
different category\_id and view the record, even if status = ‘I’  
but, i don’t want the user to modify the url and view the category where  
status \<\> ‘A’  
In short, the users get to view only status=‘A’

How do i do this for show action? (since this accepts a param)  
I made the change for list action and list is working fine and shows  
only where status=‘A’. List doesn’t accept any params such as  
“category\_id” so it was ok.

but this show accepts a param which is category\_id.

let me know how i could get the result of showing only actives and none  
other statuses, directly from the url or via show action.

thanks,  
radha.

(i have tried by best to communicate… but let me know if any is not  
clear. i will re-iterate)

thanks

---

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [June 29, 2010, 10:43am UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/2 "2010-06-29T10:43:20Z")

</div>

On 29 June 2010 03:36, RailsFan R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> inactive records. "  
> I made the change for list action and list is working fine and shows  
> only where status=‘A’. List doesn’t accept any params such as  
> “category\_id” so it was ok.
> 
> but this show accepts a param which is category\_id.
> 
> let me know how i could get the result of showing only actives and none  
> other statuses, directly from the url or via show action.

Add a condition to the find call so that it only finds active  
categories. If the id does not match a valid category then it will  
return nil.

Colin

---

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [July 2, 2010, 11:14pm UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/3 "2010-07-02T23:14:36Z")

</div>

On Jun 28, 10:36 pm, RailsFan R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Active/inactive are set via status column in category table.  
> where status=‘A’
> 
> since the url shows up in the url bar, the user can simply type in a  
> different category\_id and view the record, even if status = ‘I’  
> but, i don’t want the user to modify the url and view the category where  
> status \<\> ‘A’  
> In short, the users get to view only status=‘A’

If you’re doing this a lot, you should add it as a scope to the  
Category model:

class Category \< ActiveRecord::Base  
named\_scope :active, :conditions =\> { :status =\> ‘A’ }  
end

Then your controller action could be:

def show  
@category = Category.active.find(params[:category\_id])  
end

which will throw a RecordNotFound if the supplied ID isn’t also  
active.

BTW, the use of :category\_id in the above sample is odd - if you’re in  
CategoriesController and have the standard routing, (/categories/:id)  
the parameter will be named :id. :category\_id would be used if, for  
instance, you had a nested route to a Post model:

/categories/:category\_id/posts  
/categories/:category\_id/posts/new

etc.

–Matt J.

---

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [July 9, 2010, 12:22pm UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/4 "2010-07-09T12:22:34Z")

</div>

On 9 July 2010 03:35, RailsFan R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> What is this named\_scope. You have provided a very good example, but  
> still…

Try googling for named\_scope. It will provide many useful links.  
Did you not think of that yourself? Google is generally much quicker  
than waiting for a response on the list ( 5 seconds vs 7 hours in this  
case).

Colin

---

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [July 9, 2010, 4:35am UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/5 "2010-07-09T04:35:55Z")

</div>

Thanks Matt.

I see a lot of named\_scope question.  
I have just started with rails and have created a few paages manually  
without scaffolding, but producing the same results.  
That is where i stand with rails.

I am not clear on the named\_scope.  
Sorry for this silly question.  
What is this named\_scope. You have provided a very good example, but  
still…  
I’m sure all gurus are aware of it, i see it recommended by several ppl.

thanks in advance.

radha

Matt J. wrote:

> On Jun 28, 10:36�pm, RailsFan R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > Active/inactive are set via status column in category table.  
> > where status=‘A’
> > 
> > since the url shows up in the url bar, the user can simply type in a  
> > different category\_id and view the record, even if status = ‘I’  
> > but, i don’t want the user to modify the url and view the category where  
> > status \<\> ‘A’  
> > In short, the users get to view only status=‘A’
> 
> If you’re doing this a lot, you should add it as a scope to the  
> Category model:
> 
> class Category \< ActiveRecord::Base  
> named\_scope :active, :conditions =\> { :status =\> ‘A’ }  
> end
> 
> Then your controller action could be:
> 
> def show  
> @category = Category.active.find(params[:category\_id])  
> end
> 
> which will throw a RecordNotFound if the supplied ID isn’t also  
> active.
> 
> BTW, the use of :category\_id in the above sample is odd - if you’re in  
> CategoriesController and have the standard routing, (/categories/:id)  
> the parameter will be named :id. :category\_id would be used if, for  
> instance, you had a nested route to a Post model:
> 
> /categories/:category\_id/posts  
> /categories/:category\_id/posts/new
> 
> etc.
> 
> –Matt J.

---

<div class="post-metadata">

**Author:** ![railsfan\_radha](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/41988e/32.png) [@railsfan\_radha](https://www.ruby-forum.com/u/railsfan_radha)\
**Post date:** [July 9, 2010, 7:47pm UTC](https://www.ruby-forum.com/t/show-action-restrict-manual-url-change-from-user-to-view/190843/6 "2010-07-09T19:47:24Z")

</div>

Of course, i google and get into tutorials and books on rails.  
This one i just to want to get some inputs from experts as i am in my  
learning curve to get into rails.

thanks again for all ur help in this forum. It helps who are in the  
learning curve.

thanks,

thanks again,  
radha.

Colin L. wrote:

> On 9 July 2010 03:35, RailsFan R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > What is this named\_scope. You have provided a very good example, but  
> > still…
> 
> Try googling for named\_scope. It will provide many useful links.  
> Did you not think of that yourself? Google is generally much quicker  
> than waiting for a response on the list ( 5 seconds vs 7 hours in this  
> case).
> 
> Colin