# Simple before filter rights/acl

**URL:** <https://www.ruby-forum.com/t/simple-before-filter-rights-acl/169201>\
**Category:** Rails\
**Created:** [May 31, 2009, 6:24pm UTC](https://www.ruby-forum.com/t/simple-before-filter-rights-acl/169201 "2009-05-31T18:24:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigrails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c2a13f/32.png) [@craigrails](https://www.ruby-forum.com/u/craigrails)\
**Post date:** [May 31, 2009, 6:24pm UTC](https://www.ruby-forum.com/t/simple-before-filter-rights-acl/169201/1 "2009-05-31T18:24:47Z")

</div>

In the past, I have used a solution of Rights/Roles/Users as outlined by  
Chad F. in his original Rails Recipes but this is different.

I am dealing with a legacy application, written in PHP with users,  
passwords and security values that I can easily access in RAILS but I am  
primarily interested in using Rails to write reports and don’t see much  
need to create new tables - at least not yet.

So if I put into application\_controller.rb,

before\_filter :authenticate,  
:authorize,  
:except =\> [:login, :err\_handler]  
def authorize  
unless session[:securitylevel] \>= session[:pageseclevel]  
flash[:notice] = “You are not authorized to do that”  
request.env[“HTTP\_REFERER”] ? (redirect\_to :back,  
:params =\> @params) : (redirect\_to $SOMETHING)  
return false  
end  
end

and I try to set session[:pageseclevel] inside of each method, that  
isn’t going to work. I think I just need a way to use a before\_filter  
but have a very small table of lookup values for the security level for  
the few methods I am going to create.

Does anyone have a suggestion?

Craig

–  
This message has been scanned for viruses and  
dangerous content by MailScanner, and is  
believed to be clean.