Rails 用户配置文件页面只能由正确的用户访问

问题描述

我正在使用 devise 进行身份验证.现在，我正在设置用户配置文件.我已经设置好了一切，除了每个人都可以访问每个页面(因此您无需登录即可查看个人资料).我如何做到只有正确的用户才能看到他们自己的个人资料页面?

users_controller.rb

class UsersController <应用控制器高清秀@user = User.find(params[:id])结尾结尾

routes.rb

devise_for :users资源:用户，仅:[:show]获取用户/节目"

显示视图...

<%[email protected] %><h1>用户#show</h1><p>在 app/views/users/show.html.erb</p> 中找到我

解决方案

这个应该有助于检测 current_user 是否正确.

class UsersController <应用控制器before_action :check_user私人的def check_user如果 current_user != @userredirect_to root_url，警告:抱歉，此个人资料属于其他人！"结尾结尾结尾

I am using devise for the authentication. Right now, I'm setting up user profiles. I have everything set up, except each page is accessible for everyone (so you can see profiles without being logged in). How do I make it so that only the correct user can see their own profile page?

users_controller.rb

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
  end
end

routes.rb

devise_for :users

  resources :users, only: [:show]

  get 'users/show'

show view...

<div class="home-page-content">
  <%= @user.id %>
<h1>Users#show</h1>

<p>Find me in app/views/users/show.html.erb</p>
</div>

解决方案

This one should help to detect current_user is correct.

class UsersController < ApplicationController

    before_action :check_user

    private

    def check_user
      if current_user != @user
        redirect_to root_url, alert: "Sorry, This Profile belongs to someone else !"
      end
    end
end

这篇关于Rails 用户配置文件页面只能由正确的用户访问的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！