Search code examples
ruby-on-railsrubyruby-on-rails-3model-view-controllercontrollers

Setting user access rules with access_control in controller methods for privacy

Currently I have given access control to two actions in my controller as:

access_control [:show, :index] => 'view_questions',

[:new, :create] => 'create_questions'

But now if I disable view questions user must still be able to create questions and view his own questions. How can I modify the access control settings so that if 'view_questions' is disabled for the user, he can still view his questions?

I want to modify the action show in such a way that if 'view_questions' is disabled, he must still be able to view his questions.

Solution

  • Permission handling can very quickly get out of control when you try to roll own, especially if you're starting out. I'd highly recommend looking into something like CanCan:

    https://github.com/ryanb/cancan