Check if current_user is the owner of a resource and allow edit/delete actions
问题 Example: User A (id=10) has created a photo resource photo: (id: 1 user_id = 10, url: "http://...") Now, if User B (id=20) go to this url: /photos/1/edit it can edit photo of user A !!! Rails+Devise provides something for this by default? It seems it's a very common issue I just need to allow that any user can edit/delete ONLY resource it has created (where current_user == resource.user) Using: Rails 4, Devise Update: I think CanCan it's something too advanced. I don't need roles or restrict