inossidabile / protector

Comfortable (seriously) white-list security restrictions for models on a field level
MIT License
270 stars 31 forks source link

Using protector with globalize #40

Closed toxix closed 10 years ago

toxix commented 10 years ago

In my project I wold like to save user input in several languages. For this propose I find the Globalize gem (https://github.com/globalize/globalize).

When saving a globalized Model (with name globalized) the database is queried for somthing like this:

INSERT INTO "categories" ("created_at", "name", "updated_at") VALUES (?, ?, ?)  [["created_at", Thu, 23 Jan 2014 00:01:54 UTC +00:00], ["name", "bal"], ["updated_at", Thu, 23 Jan 2014 00:01:54 UTC +00:00]]
INSERT INTO "category_translations" ("category_id", "created_at", "locale", "name", "updated_at") VALUES (?, ?, ?, ?, ?)  [["category_id", 980190965], ["created_at", Thu, 23 Jan 2014 00:01:54 UTC +00:00], ["locale", "en"], ["name", "bal"], ["updated_at", Thu, 23 Jan 2014 00:01:54 UTC +00:00]]

Protector does it job like intended and doesn't allow this transaction on a protected model.

Is there any chance to get this two gems working together on a protected model? Or do you know an alternative gem that gives model/data translation and is working with protected models?

inossidabile commented 10 years ago

Why exactly is this getting prohibited? It doesn't look like globalize adds anything to the model itself but rather simply creates an additional insert. Which error do you get?

toxix commented 10 years ago

I don't get an error. It is just the transaction that fails, don't know why this happens. Maybe you have a hint were I can get the error description witch caused the transaction to rollback? See also below for the console output when trying to create a new record with and without protector.

Envirment to reproduce

gem 'protector', github: 'inossidabile/protector'
gem 'globalize', github: 'globalize/globalize'

rails g scaffold User admin:boolean rails g scaffold Category name:string

cat db/migrate/20140125134555_create_categories.rb

class CreateCategories < ActiveRecord::Migration
  def up
    create_table :categories do |t|
      t.string :name

      t.timestamps
    end
    Category.create_translation_table! name: :string
  end

  def down
    drop_table :cattegories
    Category.drop_translation_table!
  end
end

rake db:migrate

cat app/models/category.rb

class Category < ActiveRecord::Base

  translates :name

  protect do |user, u|
    can :read
    can :update
    can :create
  end
end

Console output

User.create admin: false
Category.create name: 'test without protector'
   (0.1ms)  begin transaction
  SQL (0.3ms)  INSERT INTO "categories" ("created_at", "name", "updated_at") VALUES (?, ?, ?)  [["created_at", Sat, 25 Jan 2014 13:57:52 UTC +00:00], ["name", "test without protector"], ["updated_at", Sat, 25 Jan 2014 13:57:52 UTC +00:00]]
  SQL (0.3ms)  INSERT INTO "category_translations" ("category_id", "created_at", "locale", "name", "updated_at") VALUES (?, ?, ?, ?, ?)  [["category_id", 1], ["created_at", Sat, 25 Jan 2014 13:57:52 UTC +00:00], ["locale", "en"], ["name", "test without protector"], ["updated_at", Sat, 25 Jan 2014 13:57:52 UTC +00:00]]
   (0.1ms)  commit transaction
=> #<Category id: 1, name: "test without protector", created_at: "2014-01-25 13:57:52", updated_at: "2014-01-25 13:57:52">

Category.restrict!(User.first).create name: 'test with protector'
  User Load (0.5ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" ASC LIMIT 1
   (0.2ms)  begin transaction
  SQL (0.8ms)  INSERT INTO "categories" ("created_at", "name", "updated_at") VALUES (?, ?, ?)  [["created_at", Sat, 25 Jan 2014 13:59:04 UTC +00:00], ["name", "test with protector"], ["updated_at", Sat, 25 Jan 2014 13:59:04 UTC +00:00]]
[deprecated] I18n.enforce_available_locales will default to true in the future. If you really want to skip validation of your locale you can set I18n.enforce_available_locales = false to avoid this message.
   (0.4ms)  rollback transaction
=> #<Category id: nil, name: "test with protector", created_at: "2014-01-25 13:59:04", updated_at: "2014-01-25 13:59:04">

c = Category.restrict!(User.first).new name: 'test with protector'
c.save
   (0.2ms)  begin transaction
  SQL (0.8ms)  INSERT INTO "categories" ("created_at", "name", "updated_at") VALUES (?, ?, ?)  [["created_at", Sat, 25 Jan 2014 14:07:00 UTC +00:00], ["name", "test with protector"], ["updated_at", Sat, 25 Jan 2014 14:07:00 UTC +00:00]]
   (0.3ms)  rollback transaction
=> false
c.errors
=> #<ActiveModel::Errors:0x00000003aed5f0 @base=#<Category id: nil, name: "test with protector", created_at: "2014-01-25 14:07:00", updated_at: "2014-01-25 14:07:00">, @messages={}>
inossidabile commented 10 years ago

https://github.com/inossidabile/protector/wiki/Protector-and-Globalize

toxix commented 10 years ago

thx. for the fast solution.