Rails 3 - CanCan - 定义创建权限

发布于 2024-10-05 22:02:51 字数 734 浏览 7 评论 0原文

我的附件控制器中有以下内容，

  def upload

    @attachment = Attachment.build(:swf_uploaded_data => params[:attachment][:attachment], :user_id => current_user.id, :project_id => params[:space_id])
....
    end

我希望 CanCan 只允许用户上传到他们所属的project_id。我确认控制器正在获取正确的信息，没有 nils

这是我的 cancan：

can :upload, Attachment do |attachment|
  Rails.logger.info 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX- include CanCan::Ability - ATTACHMENT'  
  Rails.logger.info attachment.inspect
  Rails.logger.info attachment.project

  current_user.try(:role, attachment.space)
end

这里的问题是该附件。为零，并且attachment.project 为零？如何使用 CanCan 解决此问题，以便我可以确保只有项目团队成员才能将附件上传到项目？

谢谢

原文

I have the following in my controller for Attachment

  def upload

    @attachment = Attachment.build(:swf_uploaded_data => params[:attachment][:attachment], :user_id => current_user.id, :project_id => params[:space_id])
....
    end

What I'd like from CanCan is to only allow users to upload to a project_id they belong to. I confirmed the controller is getting the correct info, no nils

Here is my cancan:

can :upload, Attachment do |attachment|
  Rails.logger.info 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX- include CanCan::Ability - ATTACHMENT'  
  Rails.logger.info attachment.inspect
  Rails.logger.info attachment.project

  current_user.try(:role, attachment.space)
end

Problem here, is that attachment. is nil, and attachment.project is nil? How do you solve for this issue with CanCan so I can make sure only project teammembers can upload attachments to the project?

Thank you

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

听你说爱我 2024-10-12 22:02:52

我认为最好的方法是使用控制器操作的 authorize! 方法在较低级别执行此操作。

所以...

#AttachmentController

#Will remove it from cancan
load_and_authorize_resource :except => [:upload]

def upload
 @attachment = Attachment.build(:swf_uploaded_data => params[:attachment][:attachment], :user_id => current_user.id, :project_id => params[:space_id])
  #add the authorize logic explicitly here when you have the attachment model populated
  authorize! :upload, @attachment
end

让我知道这是否适合您。

I think the best approach it to do it at a lower level with the authorize! method that the Controller action.

So ...

#AttachmentController

#Will remove it from cancan
load_and_authorize_resource :except => [:upload]

def upload
 @attachment = Attachment.build(:swf_uploaded_data => params[:attachment][:attachment], :user_id => current_user.id, :project_id => params[:space_id])
  #add the authorize logic explicitly here when you have the attachment model populated
  authorize! :upload, @attachment
end

Let me know if that works for you.

回复收藏 0 原文

与之呼应 2024-10-12 22:02:52

例如，如果您只想允许为当前循环创建事件：

您可以在视图中使用

link.... if can? :create, @loop.events.new

，然后在控制器中使用

skip_authorize_resource only: [:new, :create]

...

def new
   @event.loop_id = @loop.id
   authorize! :create, @event
end

#similar for create action

For example if you want to allow create events for current loop only:

You use in the view

link.... if can? :create, @loop.events.new

and then in controller

skip_authorize_resource only: [:new, :create]

...

def new
   @event.loop_id = @loop.id
   authorize! :create, @event
end

#similar for create action

回复收藏 0 原文

~没有更多了~