导轨 3 限制访问

Question

我已经使用会话制作了管理员控制器，现在我尝试限制对某些页面的访问这是我的application_controller.rb

class ApplicationController < ActionController::Base
before_filter :authorize, :except => :login
protect_from_forgery
protected
def authorize
unless User.find_by_id(session[:user_id])
  flash[:notice] = "Please log in"
  redirect_to :controller => 'admin', :action => 'login'
end
end
end

这是我试图限制其访问的控制器

class PhotosController < ApplicationController
def index
@photos = Photo.all
respond_to do |format|
  format.html # index.html.erb
  format.xml  { render :xml => @photos }
end
end
def show
@photo = Photo.find(params[:id])
respond_to do |format|
  format.html # show.html.erb
  format.xml  { render :xml => @photo }
end
end
def new
@photo = Photo.new
respond_to do |format|
  format.html # new.html.erb
  format.xml  { render :xml => @photo }
end
end
def edit
@photo = Photo.find(params[:id])
end
def create
upload = params[:upload]
@photo = Photo.new(params[:photo])
respond_to do |format|
  if @photo.save
post = Datafile.save(upload, @photo.id)
    format.html { redirect_to(@photo, :notice => 'Photo was successfully created.') }
    format.xml  { render :xml => @photo, :status => :created, :location => @photo }
  else
    format.html { render :action => "new" }
    format.xml  { render :xml => @photo.errors, :status => :unprocessable_entity }
  end
end
end
def update
@photo = Photo.find(params[:id])
respond_to do |format|
  if @photo.update_attributes(params[:photo])
    format.html { redirect_to(@photo, :notice => 'Photo was successfully updated.') }
    format.xml  { head :ok }
  else
    format.html { render :action => "edit" }
    format.xml  { render :xml => @photo.errors, :status => :unprocessable_entity }
  end
end
end
def destroy
@photo = Photo.find(params[:id])
@photo.destroy
respond_to do |format|
post = Datafile.delete(@photo.id)
  format.html { redirect_to(photos_url) }
  format.xml  { head :ok }
end
end
protected
def authorize
end
end

但它不会限制它，可以告诉我我错过了什么？

Answer 1

authorize 方法不起作用，因为您在PhotosController底部将其重新定义为空白方法。删除此重新定义，然后它将起作用。

Answer 2

从应用程序控制器交换行

  before_filter :authorize, :except => :login

有了这个

helper_method :authorize

并将此行粘贴到照片控制器中

before_filter :authorize