Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready

Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions.

Actually, I may argue that's the very first thing you do once the controller skeleton is set up.



Agreed. You don't even need to add any gems or do any rails magic for this to work. In your controller:

    def edit
      @aws_credentials = current_user.aws_credentials
    end

    def update
      current_user.aws_credentials.update_attributes(
        params[:aws_credentials].slice(:a, :b, :c)
      )
    end


Don't forget `destroy`.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: