Question

In a new action in a rails I have this:

@client_order = ClientOrder.where(:client_id => @client.id, :order_date => 
  params[:order_date] || Date.today).first_or_initialize

This works perfectly and initializes a @client_order with in that @client_order a filled in client_id

Now I have noticed that in the view I’m obligated to include this line (simple_forms)

<%= f.hidden_field :client_id %>

In order to retrieve that filled in attribute in the create action. Is this normal? What will happen when the user changes that field (through debugging the form)?

Answer 1

It’ll get the client ID given in the request.

It’s normal if that’s how the client is retrieved.

“Authorization” is the part of authentication/authorization that controls whether or not a user has access to a given resource; things like cancan address this.