search

learn-co-curriculum / sinatra-fwitter-group-project

Other
2 stars 318 forks source link

Instructions are misleading #25

Closed cdudhat closed 7 years ago

cdudhat commented 7 years ago

Last Paragraph "Protecting the Views" says -

You'll need to make sure that no one can create, read, edit or delete any tweets.

While, the test -

delete action > logged in > does not let a user delete a tweet they did not create

requires that any "logged in" user, who is not necessarily the "owner" of the tweet can also view the show page. Ideally, why would a user who does not "own" the tweet be able to see the detailed "show_tweet" page of the tweet that does not belong to him? Instead of making a non-working "Delete" and "Edit" buttons for a non belonging tweet.

Lukeghenco commented 7 years ago

Thanks @cdudhat this has been updated & fixed. Thank you for raising the issue.