# User a owns resource x; don't let user b see user a's resources

**URL:** <https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523>\
**Category:** Rails\
**Created:** [January 13, 2010, 6:55am UTC](https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523 "2010-01-13T06:55:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [January 13, 2010, 6:55am UTC](https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523/1 "2010-01-13T06:55:40Z")

</div>

I have a system of users who have many resources. For example a user  
many have many books, many friends, many items, etc. I have an  
authentication system in which users can login working just fine  
(authlogic). However, I have some default scaffold type pages for  
index. You can view a list of Users and a list of Book and a List of  
Friends. However when you go to the friends page the user can see the  
friends of all the other users too. Manually I could just modify all  
my index methods in the all the respective books friends items  
controllers to say current\_user.friends.all, … etc instead of  
Friends.all. But then still the user can view friends that aren’t  
theirs by just guessing the Id friends/32 I need a higher level system  
to enforce these rules. Not sure how to describe the design problem  
more simply is there a tool, method in place to handle such an issue.  
i would think like acts\_as\_resource (doesn’t exist) in the Friends  
model so that any can to Friends will make sure that the friend  
belongs to the user by association. This should be on the controller  
level though and not on the model I dont think.

Any ideas?

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [January 13, 2010, 3:02pm UTC](https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523/2 "2010-01-13T15:02:02Z")

</div>

Don’t take the user id from the url.

For example, don’t do this:

url:  
/show\_friends/5  
code:  
Users.find(5).friends

But do this:

url:  
/show\_friends  
code:  
current\_user.friends

where current\_user is the currently auth user. You know who is logged  
in, don’t need to pass his id around.

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [January 13, 2010, 11:13pm UTC](https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523/3 "2010-01-13T23:13:51Z")

</div>

On Wed, Jan 13, 2010 at 8:02 AM, Eduard M.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> url:  
> /show\_friends  
> code:  
> current\_user.friends
> 
> where current\_user is the currently auth user. You know who is logged  
> in, don’t need to pass his id around.

And for the use case which the OP raised, which is the show action, it  
should be:

def show  
friend = current\_user.friends.find(params[:id])  
end

which scopes the find to the user’s friends. Similar comment for  
other actions like edit and update

–  
Rick DeNatale

Blog: [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/)  
Twitter: [http://twitter.com/RickDeNatale](http://twitter.com/RickDeNatale)  
WWR: [http://www.workingwithrails.com/person/9021-rick-denatale](http://www.workingwithrails.com/person/9021-rick-denatale)  
LinkedIn: [Rick DeNatale - Developer - IBM | LinkedIn](http://www.linkedin.com/in/rickdenatale)

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [January 14, 2010, 8:10am UTC](https://www.ruby-forum.com/t/user-a-owns-resource-x-dont-let-user-b-see-user-as-resources/181523/4 "2010-01-14T08:10:34Z")

</div>

oh that’s a good solution friend = current\_user.friends.find(params  
[:id]) i never though of that. search within the users friends for  
the requested it… thanks