ruby on rails - cancan method and devise -


this ability , limited users can read own. if go through routes can still see index of other users.

i don't want put current user in index rout because limit admin user, because have models, admin , user.

class ability       include cancan::ability        def initialize(user)          if user.is_a?(admin)            can :manage, :all           elsif user.is_a?(user)            can :show, profile            can :read, profile |profile|           profile.try(:user) == user           end           can :update, profile |profile|           profile.try(:user) == user           end           can :destroy, profile |profile|           profile.try(:user) == user           end           can :create, profile          else            can :show, profile           cannot :destroy           cannot :create          end       end     end 

refctored , added restrictions see users , profiles index pages.

    class ability       include cancan::ability        def initialize(user)          if user.is_a?(admin)            can :manage, :all           elsif user.is_a?(user)           can [:show, :create], profile           can [:read, :update, :destroy], profile, user: user           cannot :index, profile           cannot :index, user         else           can :show, profile           cannot :destroy           cannot :create          end       end     end 

what have do, redirect user on access denied exception. take docs


Comments

Popular posts from this blog

cakephp - simple blog with croogo -

How to group boxplot outliers in gnuplot -

bash - Performing variable substitution in a string -