Question

maybe someone did this before me, i cant handle with this.
I have system where many users, admins. Im using extJS, JSON, Rails.

So, my question is: How in rails i can do that www.mysite.com/user/54/?format=ext_json&_dc=1306937167419&start=0&limit=50&fields=["respondent[email] CAN SEE ONLY ADMINS and just average users can see text “Sorry, only admins” ??

if simple, *.json pages can see only admins.

this is my controller

  def uz   
    @answers      = Question.find(params[:id])

    if session[:user].is_admin == 1

    end

    respond_to do |format|
      format.ext_json { render :json => @answers.to_ext_json(:class => Answer, :include => [:respondent]) }
    end
  end

im tried this (create before_filter) but nothing

  def checking
    if session[:user].is_admin == 1
        WHAT TO DO HERE
    end
  end

Answer 1

You can create before_filter in controller where you can check format, action and session and return 404 error page

http://apidock.com/rails/ActionController/Filters/ClassMethods/before_filter

before_filter :admin_required

...

private
def admin_required


  case params[:format].to_sym
  when :ext_json 
     #....redirect with eror or something if not admin
  end
end