Using Devise to create private profiles

问题

I am currently trying to create private user profiles using the Devise gem. So far I have the sign up, login, sign out and edit profile functionality working. The problem is that when a user signs in he is able to see all other users by typing into the url users/[username]. I am relatively new to rails so I am still figuring out how to work with sessions.

So the quesiton is how do I limit a user's access to parts of a site that are specific to other users? And even better, is this easily done with the Devise gem?

In other words if i sign is as user john. I should be able to see the site /users/john (which is my profile) but not see the site /user/greg.

thanks

回答1:

Devise will not do this, but CanCan will, as someone mentioned. CanCan may be a little heavy for a beginner just to do what you are trying to do. All you need to do is add a before_filter that checks who the user is.

For example:

class UserProfilesController < ApplicationController

  before_filter :verify_owner

  def show
    @user_profile = current_user.user_profile
    # or maybe this way, not sure how you have your relations set up
    # @user_profile = UserProfile.where(:user => current_user)
  end

private

  def verify_owner
    # assume the route looks like this  /user/:username
    redirect_to root_url unless current_user.username == params[:username]
  end    

end

回答2:

Use CanCan to help for authorization. Devise + CanCan nothing else!

There is a great RailsCast on CanCan to get started with.

来源：https://stackoverflow.com/questions/7458723/using-devise-to-create-private-profiles

标签

ruby-on-rails

devise

authorization