search

ryanb / cancan

Authorization Gem for Ruby on Rails.
MIT License
6.27k stars 783 forks source link

Authorizing update/create actions if the model accepts_nested_attributes_for associated models #852

Open bewithjonam opened 11 years ago

bewithjonam commented 11 years ago

I have a form in the users account settings from which user can update multiple models like photos, items (associated to users model) in one shot. The user model accepts_nested_attributes_for photos and items. The post params from the form, if not validated and authorized, then the user can edit/update other users photos/items.

Accepts_nested_attributes_for is a common use-case, sorry if I am missing something.

jaredbeck commented 11 years ago

How are you authorizing? Are you using authorize! or authorize_resource, or load_and_authorize_resource? Which version of cancan are you using? Can you include the relevant line from your Gemfile?

jaredbeck commented 11 years ago

If you're using load_and_authorize_resource, you might want to check out the wiki page on Nested Resources. For example,

load_and_authorize_resource :user
load_and_authorize_resource :photo, :through => :user
xhoy commented 10 years ago

Dear submitter, Since cancan/raynB hasn't been active for more than 6 months and no body else then ryam himself has commit permissions the cancan project is on a stand still. Since cancan has several issues including missing support for rails 4 cancan is moving forward to cancancan. More details on: #994

If your feel that your pull request or bug is still applicable (and hasn't been merged in to cancan) it would be really appreciated if you would resubmit it to cancancan (https://github.com/cancancommunity/cancancan)

We hope to see you on the other side!