Rails - 使页面只能被管理员查看

Question

我有一个非常简单的问题.我有一个页面列出了我的应用程序中的所有产品.我只想让管理员只查看该页面.但产品/新产品我希望每个人都能清楚地看到.

schema.rb

  create_table "users", :force => true do |t|
    t.string   "email"
    t.string   "password_hash"
    t.string   "password_salt"
    t.datetime "created_at",      :null => false
    t.datetime "updated_at",      :null => false
    t.string   "name"
    t.boolean  "admin",           :default => false
  end

产品控制器

class ProductsController < ApplicationController
    before_filter :require_login
    before_filter :current_user, only: [:create, :destory]
    before_filter :correct_user, only: :destory

  def index
    @products = Product.all
  end

  def new 
    @product = Product.new
  end

  def create
  @product = current_user.products.new(params[:product])
    if @product.valid? 
      @product.save
        render "show", :notice => "Sale created!"
    else
        render "new", :notice => "Somehting went wrong!"
    end
end

Answer 1

放入你的控制器

before_filter :authorize_admin, only: :index

并在application_controller.rb中

def authorize_admin
    redirect_to :back, status: 401 unless current_user.admin
    #redirects to previous page
end