Question

Following Hartl’s Railstutorial on Chapter 10 where we protect user edit pages so that users can only edit their info. http://ruby.railstutorial.org/chapters/updating-showing-and-deleting-users#sec:protecting_pages

Is there a way to deny access to a user’s home page (http://localhost:3000/users/1) if the user ID does not match the ID from the page being accessed or if the user is not signed in? Essentially, this only allows the user to view the page if his id matches the user page’s id.

Answer 1

The tutorial already defines a correct_user before_filter which checks if the current logged in user is equal to the user found from params[:id].

You’re already using it to make sure the user can only edit/update his or her info.

before_filter :correct_user, :only => [:edit, :update]

All you have to do is add that filter to the show action.

before_filter :correct_user, :only => [:show, :edit, :update]

edit: I forgot to add that @user = User.find(params[:id]) is no longer needed in the show action since it’ll be set by the before filter.