Question

我已经使用会话创建了管理员控制器，现在我尝试限制访问某些页面这是我的application_controller.rb

class ApplicationController < ActionController::Base
before_filter :authorize, :except => :login
protect_from_forgery

protected
def authorize
unless User.find_by_id(session[:user_id])
  flash[:notice] = "Please log in"
  redirect_to :controller => 'admin', :action => 'login'
end
end
end

这是我试图限制其访问的控制器

class PhotosController < ApplicationController

def index
@photos = Photo.all
respond_to do |format|
  format.html # index.html.erb
  format.xml  { render :xml => @photos }
end
end

def show
@photo = Photo.find(params[:id])
respond_to do |format|
  format.html # show.html.erb
  format.xml  { render :xml => @photo }
end
end

def new
@photo = Photo.new
respond_to do |format|
  format.html # new.html.erb
  format.xml  { render :xml => @photo }
end
end

def edit
@photo = Photo.find(params[:id])
end

def create
upload = params[:upload]
@photo = Photo.new(params[:photo])
respond_to do |format|
  if @photo.save
post = Datafile.save(upload, @photo.id)
    format.html { redirect_to(@photo, :notice => 'Photo was successfully created.') }
    format.xml  { render :xml => @photo, :status => :created, :location => @photo }
  else
    format.html { render :action => "new" }
    format.xml  { render :xml => @photo.errors, :status => :unprocessable_entity }
  end
end
end

def update
@photo = Photo.find(params[:id])
respond_to do |format|
  if @photo.update_attributes(params[:photo])
    format.html { redirect_to(@photo, :notice => 'Photo was successfully updated.') }
    format.xml  { head :ok }
  else
    format.html { render :action => "edit" }
    format.xml  { render :xml => @photo.errors, :status => :unprocessable_entity }
  end
end
end

def destroy
@photo = Photo.find(params[:id])
@photo.destroy
respond_to do |format|
post = Datafile.delete(@photo.id)
  format.html { redirect_to(photos_url) }
  format.xml  { head :ok }
end
end

protected

def authorize
end

end

但它不会限制它，可以告诉我我缺少什么？

Answer 1

authorize方法无效，因为您在PhotosController底部将其重新定义为空白方法。删除此重新定义，然后它将起作用。

Answer 2

来自应用程序控制器的交换行

  before_filter :authorize, :except => :login

用这个

helper_method :authorize

并将此行粘贴到照片控制器

中

before_filter :authorize

导轨3限制访问

2 个答案: