Question

I have 3 Controllers: Sites, Users & Sessions. I have all of the authentication setup, and I set the object current_user in the applications controller once a user logs in. Now, all I want to do is only allow users to see their sites (the sites model has a: “belongs_to :user”).

class SitesController < ApplicationController

def index
    #this was Site.all, but I changed it. Is there a better way to do this?
    @sites = Site.find_all_by_user_id(current_user.id)
    # respond to ... etc
end

# Now, for show, edit and update, I want to ensure the site belongs to the user. How can I add that?
def show
    @site = Site.find(params[:id])
    # respond to ... etc
end

If more information is needed (the model, entire controller, etc), just let me know and I’ll ad it!

Thanks!

Answer 1

I can’t catch up your idea very clearly. But seems what you want is something like below:

def show
    @site = Site.find(params[:id])

    # check if the site belong to current user
    redirect_to some_user_default_path if @sites.user != @current_user

    # respond to ... etc
end

Hope it can help.