Question

I know Auth normally restricts all actions except add/login, etc.

But if a model has a default delete() function in the controller, how is it normally done in the CakePHP way to make sure that an authenticated user can’t delete a id that does not belong to him? Yeah I know I could look up the user_id of the thing that is being deleted and compare it to the Auth.Userid but is there an easier way?

Answer 1

I think only login is allowed by default.

I don’t think there’s an easier way, but there’s certain shortcut that you can take:

function delete(){
    if(!empty($this->data)){
      $this->Model->id = $this->data['Model']['id'];
      if($this->Model->field('user_id') == $this->Auth->user('id'))$this->Model->delete();
    }
    //redirect somewhere
 }