Question

I am having issues with devise current_user confusing my model’s :id as the users :id.

routes:

match "/causes/:id/:slug" => "causes#show", :as => :cause, :via => 'get'
match "/causes/:id/:slug/edit" => "causes#edit", :as => :edit_cause, :via => 'get'
match "/causes/:id/:slug" => "causes#update", :via => 'put'

resources :causes, :only => [:index, :new, :create]

in my :causes controller:

before_filter :check_privileges, only: [:new, :create, :edit, :new, :update]

def check_privileges
    #when I use this code everyone can access edit, etc.
    redirect_to root_path unless current_user
end

and in my :causes model

  belongs_to :user

For some reason, when I use current_user at all, in this controller, it always thinks that current_user is equal to the id in /causes/:id/:slug/

I have tried putting the check privileges code in the application controller,

I have even tried assigning code like this:

def check_privileges
    #when I use this code no one can access edit, etc
    @user = User.find_by_id(params[:id])
    redirect_to root_path unless @user
end

I need help, anyone have suggestions? All I want it to do is verify the user is the current user so not everyone can edit the cause.

Answer 1

Your post is a bit confusing. IIRC devise stores the current user id in the session and does not ever get it from the url.

Seeing that this is a problem associated with privileges and rolling out your own solution. I would highly recommend an alternative.

https://github.com/ryanb/cancan

This works great with devise and should solve your problems