I am using CanCanCan and in my ability.rb file I have this:
def initialize(user)
alias_action :vote_up, :vote_down, to: :vote
user ||= User.new # guest user (not logged in)
if user.admin?
can :manage, :all
else
can :manage, Question, user_id: user.id
can :manage, Answer, user_id: user.id
can :manage, Job, user_id: user.id
can :manage, Company, user_id: user.id
can :read, :all
cannot :read, User do |u|
!u.eql?(user.id)
end
can :vote, [Question, Answer]
end
end
However, when I try to vote with a user that doesn't own a question, it rejects it.
For instance, when I am logged in as abc@test.com, this is what the log looks like on a vote:
Started POST "/questions/yet-another-hello-world/vote_up" for ::1 at 2016-06-14 23:45:13 -0500
Processing by QuestionsController#vote_up as JS
Parameters: {"id"=>"yet-another-hello-world"}
User Load (2.4ms) SELECT "users".* FROM "users" WHERE "users"."id" = $1 ORDER BY "users"."id" ASC LIMIT $2 [["id", 1546], ["LIMIT", 1]]
Question Load (4.8ms) SELECT "questions".* FROM "questions" WHERE "questions"."user_id" = $1 AND "questions"."slug" = $2 ORDER BY "questions"."id" ASC LIMIT $3 [["user_id", 1546], ["slug", "yet-another-hello-world"], ["LIMIT", 1]]
Answer Load (1.4ms) SELECT "answers".* FROM "answers" WHERE "answers"."question_id" = 43
(1.3ms) SELECT COUNT(*) FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."voter_id" = $3 AND "votes"."vote_scope" IS NULL AND "votes"."voter_type" = $4 [["votable_id", 43], ["votable_type", "Question"], ["voter_id", 1546], ["voter_type", "User"]]
(0.7ms) BEGIN
SQL (3.8ms) INSERT INTO "votes" ("votable_type", "votable_id", "voter_type", "voter_id", "vote_flag", "vote_weight", "created_at", "updated_at") VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING "id" [["votable_type", "Question"], ["votable_id", 43], ["voter_type", "User"], ["voter_id", 1546], ["vote_flag", true], ["vote_weight", 1], ["created_at", 2016-06-15 04:45:13 UTC], ["updated_at", 2016-06-15 04:45:13 UTC]]
(0.9ms) COMMIT
(1.3ms) SELECT COUNT(*) FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"]]
(1.4ms) SELECT COUNT(*) FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", true]]
(1.4ms) SELECT COUNT(*) FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", false]]
(1.6ms) SELECT SUM("votes"."vote_weight") FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", true]]
(1.5ms) SELECT SUM("votes"."vote_weight") FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", false]]
CACHE (0.0ms) SELECT SUM("votes"."vote_weight") FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", true]]
CACHE (0.0ms) SELECT SUM("votes"."vote_weight") FROM "votes" WHERE "votes"."votable_id" = $1 AND "votes"."votable_type" = $2 AND "votes"."vote_flag" = $3 AND "votes"."vote_scope" IS NULL [["votable_id", 43], ["votable_type", "Question"], ["vote_flag", false]]
(0.8ms) BEGIN
SQL (2.1ms) UPDATE "questions" SET "cached_votes_total" = $1, "cached_votes_up" = $2, "cached_votes_score" = $3, "cached_weighted_total" = $4, "cached_weighted_score" = $5, "updated_at" = $6 WHERE "questions"."id" = $7 [["cached_votes_total", 1], ["cached_votes_up", 1], ["cached_votes_score", 1], ["cached_weighted_total", 1], ["cached_weighted_score", 1], ["updated_at", 2016-06-15 04:45:13 UTC], ["id", 43]]
(1.5ms) COMMIT
Rendering questions/vote_up.js.erb
Rendered questions/vote_up.js.erb (1.3ms)
Completed 200 OK in 69ms (Views: 14.8ms | ActiveRecord: 26.9ms)
Which is normal and works wonderfully.
However, if I login as another user and try to vote_up that same question, this is what the log looks like:
Started POST "/questions/yet-another-hello-world/vote_up" for ::1 at 2016-06-14 23:46:40 -0500
Processing by QuestionsController#vote_up as JS
Parameters: {"id"=>"yet-another-hello-world"}
User Load (2.1ms) SELECT "users".* FROM "users" WHERE "users"."id" = $1 ORDER BY "users"."id" ASC LIMIT $2 [["id", 1547], ["LIMIT", 1]]
Question Load (3.2ms) SELECT "questions".* FROM "questions" WHERE "questions"."user_id" = $1 AND "questions"."slug" = $2 ORDER BY "questions"."id" ASC LIMIT $3 [["user_id", 1547], ["slug", "yet-another-hello-world"], ["LIMIT", 1]]
Completed 404 Not Found in 14ms (ActiveRecord: 5.3ms)
ActiveRecord::RecordNotFound - ActiveRecord::RecordNotFound:
friendly_id (5.1.0) lib/friendly_id/finder_methods.rb:23:in `find'
app/controllers/questions_controller.rb:123:in `set_question'
You can see that it is checking if the question belongs to the current_user in my controller but it fails here:
def set_question
@question = current_user.questions.includes(:answers).friendly.find(params[:id])
end
Thoughts?
@question = current_user.questions.includes(:answers).friendly.find(params[:id])
This is where went wrong, since current_user doesn't own the question, the question couldn't be found with both question_id and user_id. You could see what the query does in the log:
SELECT "questions".* FROM "questions" WHERE "questions"."user_id" = $1 AND "questions"."slug" = $2 ORDER BY "questions"."id" ASC LIMIT $3 [["user_id", 1547], ["slug", "yet-another-hello-world"], ["LIMIT", 1]]
Change the finding question query to this:
@question = Question.includes(:answers).friendly.find(params[:id])
Now all users could vote the question even if the question is not owned by him/her.