如何隐藏"私人"显示其他用户的页面？

Question

换句话说,如果用户输入例如:

http://0.0.0.0:3000/goals/3

即使用户将其提交为"私人",他们也能够看到该用户的目标.这是我忽略的,因为它通过"私人"提交通过用户的个人资料和订阅源隐藏目标,但是如果其他用户通过网址直接搜索它则不会.

我们该如何解决这个问题？

goals_controller

class GoalsController < ApplicationController
  before_action :set_goal, only: [:show, :edit, :update, :destroy, :like, :user_goals]
  before_action :logged_in_user, only: [:create, :destroy]
  before_action :correct_user, only: [:edit, :update, :destroy]

  def index
    if params[:tag]
      @goals = Goal.tagged_with(params[:tag])
    elsif params[:user_id]
      @accomplished_goals = User.find(params[:user_id]).goals.accomplished.order("deadline")
      @unaccomplished_goals = User.find(params[:user_id]).goals.unaccomplished.order("deadline")
    else
      @accomplished_goals = current_user.goals.accomplished.order("deadline")
      @unaccomplished_goals = current_user.goals.unaccomplished.order("deadline")
    end
  end

  def user_goals
      @goals = Goal.find_by({user_id: params[:user_id]})
      render :index # or some other view
  end

  def show
    @goal = Goal.find(params[:id])
    @commentable = @goal
    @comments = @commentable.comments
    @comment = Comment.new
    @notable = @goal
    @notes = @notable.notes
    @note = Note.new
    @correct_user = current_user.goals.find_by(id: params[:id])
  end

  def new
    @goal = current_user.goals.build
  end

  def edit
  end

  def create
    @goal = current_user.goals.build(goal_params)
    if (params[:commit] == 'conceal')
      @goal.conceal = true
      @goal.save
      redirect_to @goal, notice: 'Goal was successfully created'
    elsif
      @goal.save
      track_activity @goal
      redirect_to @goal, notice: 'Goal was successfully created'
    else
      flash.now[:danger] = 'Required Field: "Enter Goal"'
      render 'new'
    end
  end

  def update
    if @goal.update(goal_params)
      redirect_to goals_url, notice: 'Goal was successfully updated'
    else
      render action: 'edit'
  end
end

  def destroy
    @goal.destroy
    redirect_to goals_url
  end

  def like
    @goal = Goal.find(params[:id])
    @goal_like = current_user.goal_likes.build(goal: @goal)
    if @goal_like.save
      @goal.increment!(:likes)
      flash[:success] = 'Thanks for liking!'
    else
      flash[:error] = 'Two many likes'
    end  
      redirect_to(:back)
  end

  private
    def set_goal
      @goal = Goal.find(params[:id])
    end

    def correct_user
      @goal = current_user.goals.find_by(id: params[:id])
      redirect_to root_url, notice: "Not authorized to edit this goal" if @goal.nil?
    end

    def goal_params
      params.require(:goal).permit(:name, :like, :deadline, :accomplished, :tag_list, :comment, :private_submit)
    end
end

goal.rb

class Goal < ActiveRecord::Base
    scope :publish, ->{ where(:conceal => false) }
    belongs_to :user
    scope :accomplished, -> { where(accomplished: true) }
    scope :unaccomplished, -> { where(accomplished: false) }
end

Answer 1

请考虑其中一个铁路授权宝石.在我的拙见中,最简单的就是专家.在使用pundit的情况下,您需要执行以下步骤:

# Goals controller
def set_goal
  @goal = Goal.find(params[:id])
  authorize @goal
end

# GoalPolicy
def show?
  (goal.private? and goal.user == current_user) or not goal.private?
end

流行的红宝石授权宝石的完整列表