# Users have roles now but how can they edit there own posts

**URL:** <https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540>\
**Category:** Rails\
**Created:** [February 14, 2007, 12:50pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540 "2007-02-14T12:50:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 12:50pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/1 "2007-02-14T12:50:58Z")

</div>

Using the book Rails recipes i found out how i can set different roles  
for different types of users.  
everything works well when a user registerd himself he gets  
automatically the right role for user.

But now i have another problem.  
How can i make that users can edit only there own posts.  
Is there a howto or something

---

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 3:25pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/2 "2007-02-14T15:25:36Z")

</div>

I’d try something like Post has\_many [or has\_one] :users then check user  
is  
in the array of users [or is the one user].

RSL

---

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 3:46pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/3 "2007-02-14T15:46:39Z")

</div>

As you would have to do that check for more than one action, namely  
the edit action (which displays the edit form), the update action that  
updates the record, and the delete action that deletes it (if users  
are allowed for that), i would suggest using a before\_filter that gets  
the post in Question, and checks if the user who wrote it is the user  
who requested the action:

class Posts \< ActionController

before\_filter :check\_priviliges, :only =\> [:edit,:update,:delete]

…your actions…

private  
def check\_priviliges  
@post = Post.find\_by\_id(params[:id],:include =\> :user)  
if @post.user.id = session[:user][:id]  
true  
else  
redirect\_to …your error\_page…  
end  
end

end

of course the Post Model needs to have a relationship to User:

class User \< ActiveRecord  
has\_many :posts  
end  
class User \< ActiveRecord  
belongs\_to :user  
end

You can also additionally check in the before\_filter, weither the user  
is an Admin, if Admins can edit all Posts, for example.  
As i don’t know Rails Recipes Book the above code is only a pointer as  
your book’s example probably handles users/sessions a bit differently.

Greets.

---

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 4:58pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/4 "2007-02-14T16:58:09Z")

</div>

I set all the relationnshiops so as describes here and in the books.  
But the user\_id is NULL at each post.  
with comments the post\_id works well but with user\_id the database alays  
returns null

---

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 4:27pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/5 "2007-02-14T16:27:45Z")

</div>

I didn’t say I was giving you _everything_ you need to solve the  
problem.  
Just a headstart. 😉

RSL

---

<div class="post-metadata">

**Author:** ![gorter9](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/839c29/32.png) [@gorter9](https://www.ruby-forum.com/u/gorter9)\
**Post date:** [February 14, 2007, 5:07pm UTC](https://www.ruby-forum.com/t/users-have-roles-now-but-how-can-they-edit-there-own-posts/85540/6 "2007-02-14T17:07:12Z")

</div>

Okay it’s only possible with a select to set the user\_id not  
automatically at the moment.