search

inossidabile / protector

Comfortable (seriously) white-list security restrictions for models on a field level
MIT License
270 stars 31 forks source link

Default protection subject? #13

Closed fdeschenes closed 11 years ago

fdeschenes commented 11 years ago

How would you feel or have you thought about creating an option to set the default protection subject instead of having to call restrict! on each class/object? I think this could complement the new paranoid setting.

inossidabile commented 11 years ago

I can't come up with the use-case. Could you please provide one so I could get the idea?

fdeschenes commented 11 years ago

Without getting into too much detail, I just find that I'm calling restrict!(current_user) everywhere except for one or two places and I was thinking it may be easier to unrestrict those rather than having the restrict everything. But perhaps being more explicit is the way to go.

If you'd like a really detailed use-case, I'll try and write something up later today.

inossidabile commented 11 years ago

I would really appreciate it. I have a plan on making Protector::CanCan gem to integrate those. Protector can be a nice source for the CanCan. And latter could make all that restrictions on a controllers level for you. So probably it would fit the requirement. But we'll know that as soon as you list them :neckbeard:

inossidabile commented 11 years ago

Look at this: https://github.com/inossidabile/protector-cancan and tell me what you think.

fdeschenes commented 11 years ago

I love the way you've implement it and I think that it'll do exactly what I need it to do.