0

我正在使用这个应用程序，我遇到的唯一问题是当用户登录时，他们可以看到公共帖子，即使他们没有创建它。

有没有办法让它不与其他用户的帖子一起显示？

该应用程序的重点是用户可以登录并创建帖子，这些默认情况下是私有的，这意味着只有他们可以看到它，如果用户将帖子公开，我希望它是未登录或登录的用户可以查看但是，这正是我所拥有的，但所有公共帖子都会与其他用户的帖子一起显示。

这是应用程序控制器：

class ApplicationController < ActionController::Base
  protect_from_forgery
  rescue_from ActiveRecord::RecordNotFound, :with => :handle_not_found

    def handle_not_found
      respond_to do |type|
        type.html { redirect_to root_path, :notice => 'Record not found'}
        type.all  { render :nothing => true, :status => 404 }
      end
      true
    end
end

这是后控制器：

class PostsController < ApplicationController

  before_filter :authenticate_user!, :except => [:index, :show]

  # GET /posts
  # GET /posts.json
  def index
    @posts = current_user ? Post.public_or_owned_by(current_user) : nil
    render :template => current_user ? 'posts/index_logged_in' : 'posts/index_not_logged_in'
  end

  # GET /posts/1
  # GET /posts/1.json
  def show
    @post = current_user ? Post.public_or_owned_by(current_user).find_by_url_id!(params[:id]) : Post.public.find_by_url_id!(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.json { render json: @post }
    end
  end

  # GET /posts/new
  # GET /posts/new.json
  def new
    @post = Post.new

    respond_to do |format|
      format.html # new.html.erb
      format.json { render json: @post }
    end
  end

  # GET /posts/1/edit
  def edit
    @post = current_user.posts.find_by_url_id(params[:id])
  end

  # POST /posts
  # POST /posts.json
  def create
    @post = current_user.posts.build(params[:post])

    respond_to do |format|
      if @post.save
        format.html { redirect_to @post, notice: 'Post was successfully created.' }
        format.json { render json: @post, status: :created, location: @post }
      else
        format.html { render action: "new" }
        format.json { render json: @post.errors, status: :unprocessable_entity }
      end
    end
  end

  # PUT /posts/1
  # PUT /posts/1.json
  def update
    @post = current_user.posts.find_by_url_id(params[:id])

    respond_to do |format|
      if @post.update_attributes(params[:post])
        format.html { redirect_to @post, notice: 'Post was successfully updated.' }
        format.json { head :no_content }
      else
        format.html { render action: "edit" }
        format.json { render json: @post.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /posts/1
  # DELETE /posts/1.json
  def destroy
    @post = current_user.posts.find_by_url_id(params[:id])
    @post.destroy

    respond_to do |format|
      format.html { redirect_to posts_url }
      format.json { head :no_content }
    end
  end
end

这是帖子模型：

class Post < ActiveRecord::Base
  belongs_to :user
  before_create :generate_url_id

  attr_accessible :title, :body, :is_public

  scope :public, where(:is_public => true)

  def self.public_or_owned_by(user)
    t = Post.arel_table
    Post.where(t[:user_id].eq(user.id).or(t[:is_public].matches(true)))
  end

  def generate_url_id
    self.url_id = SecureRandom.urlsafe_base64
  end

  def to_param
    self.url_id
  end

end

这是用户模型：

class User < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :token_authenticatable, :confirmable,
  # :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :password, :password_confirmation, :remember_me
  # attr_accessible :title, :body
  has_many :posts
end
4

1 回答 1

0

仍然不确定我是否理解你想要什么，但我会使用两条不同的路线：

 resources :posts     # see all public posts from everyone
 resources :users do
   resources :posts   # nested route for a user to only see his own posts
 end

所以在你的控制器中，你将拥有：

 def index
   if params[:user_id]
     if current_user && current_user.id == params[:user_id].to_i
       # see all posts for a user, even non-public ones
       @posts = Post.where( user_id: params[:user_id] ) 
     else
       # see public posts from a user
       @posts = Post.public.where( user_id: params[:user_id] )
     end
   else
     # see all public posts
     @posts = Post.public 
   end
 end

这不是你能做的最好的，但它是功能性的。更好的方法是使用一些授权机制，例如CanCan。

于 2012-12-08T12:37:04.840 回答