Question

I am slowly learning rails by doing and testing things, but i have run into a block. I have a simple rails 3.1 app and have a simple user register/sign in process working. I am not using devise because i would rather learn how to do it myself.

Currently a user can register, sign in and sign out. But I want them to be able to edit their profile. At present any user can go to users/1/edit/ even if their ID isn’t set to 1. How do i check to see if the current_user matches that of the url? I know i need some sort of before filter on the edit action of my users_controller.

Here is what i have at present

users_controller.rb

before_filter :is_owner, :only => [:edit, :update, :destroy]

application_controller.rb

helper_method :is_owner
def is_owner
end

What should be in my is_owner function?

Answer 1

I’m guessing your problem resides in getting the parameter from the URL. This could be done with the params array:

params[:id]

With that (depending on your routing configuration!), you could do something like

def is_owner?
  current_user.id == params[:id]
end