1

I have users and projects scaffolds in my Rails project. I also have an admin controller and view that is only accessible to admin users. I want the index and create controller actions for the users and projects models to be only accessible to the admin view (using render :partial > 'index') but I do not want to let the visitors to the site to be able to type in http://railsapp.host/users and get the partial rendered. How do I achieve this?

TO clarify, my issue is not about the user role. I have authlogic with all the require_admin helpers but I dont even want an admin user to be able to access the index route for users directly from the browser. In effect I want to limit the index controller action only to the view code of admin#index like this:

<%= render '/users/index' %>
1

4 Answers 4

2

The best rails way is define a filter in application controller

 class UsersController < ApplicationController
   before_filter :check_isadmin?, :only => [:create, :index]
 end
 class ProjectsController < ApplicationController
   before_filter :check_isadmin?, :only => [:create, :index]
 end
 class ApplicationControlloller < ApplicationController
   def check_isadmin?
      current_user.admin?
    end
end
1
  • Thanks for the response. I wasn't clear in my question - I just edited it. Please see edit.
    – pvenky
    Nov 3, 2012 at 13:30
0

If you use role for different user, you can check the role of admin user then render partial, ex:

<% if user.isAdmin? %>
  <%= render 'index' %>
<% end %>
3
  • Thanks for the response. I wasn't clear in my question - I just edited it. Please see edit.
    – pvenky
    Nov 3, 2012 at 13:32
  • i'm not understand what you want to do yet, but if you want to set abilities of users, you can try Can Can gem.
    – Thanh
    Nov 3, 2012 at 13:38
  • Thanh, I have a users#index controller action that renders a partial. But this partial is embedded in the admin#index view. I dont want anyone to be able to type in https://localhost/users and get the partial. In effect I need to be able to discern in my users controller whether the request is coming from a web address typed in directly into the browser, or coming during the rendering of admin#index action.
    – pvenky
    Nov 3, 2012 at 13:45
0

Ok, I should have said I was a relative noob to rails. I figured it out though. I thought the

<%= render '/users/index' %>

actually goes through the users#index code. I just figured out that it was just calling the partial under the views without going through the controller action. So I simply added this to the users controller

def index
  redirect_to :controller=>'admin', :action=>'index'
end

And that seems to achieve the goal I was seeking.

Thanks for all your help.

0

Complementing on Aayush Khandelwal answer which was helpful for me before_filter is depreciated on Rails 5. Use before_action instead.

class UsersController < ApplicationController
   before_action :check_isadmin?, :only => [:create, :index]
end

and in :check_isadmin? redirecto to an other page if false.

def check_isadmin?
  if current_user == nil || !current_user.admin?
    redirect_to root_path
  end
end 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.