Question

我在rails网站上有一些页面只能由用户和管理员访问，我使用user_signed_in？将其隐藏在视图中的公共内容。

问题是当您未登录时复制并粘贴页面的URL 你仍然可以访问它们。

我想象我需要在这些页面的控制器中添加它。

任何帮助都会很棒，因为我还在学习rails。

例如我想保护这个控制器

class DailiesController < ApplicationController
  before_filter :authenticate_admin!, except: [:index, :show]
  before_action :set_daily, only: [:show, :edit, :update, :destroy]

  # GET /dailies
  # GET /dailies.json
  def index
    @dailies = Daily.order("created_at desc")
 end

  # GET /dailies/1
  # GET /dailies/1.json
  def show
  end

  # GET /dailies/new
  def new
    @daily = current_admin.dailies.new
  end

  # GET /dailies/1/edit
  def edit
    @daily = current_admin.dailies.find(params[:id])
  end

  # POST /dailies
  # POST /dailies.json
  def create
    @daily = current_admin.dailies.new(daily_params)

    respond_to do |format|
      if @daily.save
        format.html { redirect_to @daily, notice: 'Post was successfully created.' }
        format.json { render action: 'show', status: :created, location: @daily }
      else
        format.html { render action: 'new' }
        format.json { render json: @daily.errors, status: :unprocessable_entity }
      end
    end
  end

  # PATCH/PUT /dailies/1
  # PATCH/PUT /dailies/1.json
  def update
    @daily = current_admin.dailies.find(params[:id])

    respond_to do |format|
      if @daily.update(daily_params)
        format.html { redirect_to @daily, notice: 'daily was successfully updated.' }
        format.json { head :no_content }
      else
        format.html { render action: 'edit' }
        format.json { render json: @daily.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /dailies/1
  # DELETE /dailies/1.json
  def destroy
    @daily = current_admin.dailies.find(params[:id])

    @daily.destroy
    respond_to do |format|
      format.html { redirect_to dailies_url }
      format.json { head :no_content }
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_daily
      @daily = Daily.find(params[:id])
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def daily_params
      params.require(:daily).permit(:description, :image)
    end

end

Answer 1

您是否已经创建了一个名为authenticate_admin的方法？

你可以尝试这样的事情

before_action :has_access?

    def has_access?
      redirect_to root_path unless user_signed_in? && current_user.admin?
    end

在铁轨中保护网址

1 个答案: