【问题标题】:RoR: Controller Submit with paramsRoR:控制器提交参数
【发布时间】:2011-06-27 22:43:40
【问题描述】:

我正在通过本教程编写一个条目提交控制器:http://www.communityguides.eu/articles/1

当我尝试提交条目时,我得到Users can't be blank...我不想将 user_id 作为隐藏字段传递,对吗?那么我应该如何更改它以自动获取用户的ID?

我正在使用设计进行身份验证。 :) 我是一个完整的 Rails 新手。 这是我的控制器:

    def submit
      @entry = current_user.articles.find(params[:id])

      # submit only, if article is currently in draft or rejected-state
      if (@entry.state == 0) or (@article.state == 2)
        @entry.state = 1
        @entry.submitted = Time.now

        if @entry.save
          flash[:notice] = 'Your article was successfully submitted for approval.'
        else
          flash[:error] = 'There was an error while submitting your article.'   
        end           
      else
        flash[:error] = 'This article can not be submitted.'  
      end

      respond_to do |format|
        format.html { redirect_to(:action => 'myarticles') }
        format.xml  { head :ok }
      end
    end
  # GET /entries/1/edit
  def edit
    @entry = Entry.find(params[:id])
  end

  # POST /entries
  # POST /entries.xml
  def create
    @entry = Entry.new(params[:entry])

    respond_to do |format|
      if @entry.save
        format.html { redirect_to(@entry, :notice => 'Entry was successfully created.') }
        format.xml  { render :xml => @entry, :status => :created, :location => @entry }
      else
        format.html { render :action => "new" }
        format.xml  { render :xml => @entry.errors, :status => :unprocessable_entity }
      end
    end
  end

  # PUT /entries/1
  # PUT /entries/1.xml
  def update
    @entry = current_user.entries.find(params[:id])

        #if the entry has been approved, the user cannot change the title or URL.
        if @entry.state > 2
            params[:entry].delete(:title)
            params[:entry].delete(:url)
        end
    respond_to do |format|
      if @entry.update_attributes(params[:entry])
        format.html { redirect_to(@entry, :notice => 'Entry was successfully updated.') }
        format.xml  { head :ok }
      else
        format.html { render :action => "edit" }
        format.xml  { render :xml => @entry.errors, :status => :unprocessable_entity }
      end
    end
  end

【问题讨论】:

    标签: ruby-on-rails model-view-controller controller


    【解决方案1】:

    从您的描述看来,您在尝试创建新条目时会遇到此错误。

      def create
        @entry = current_user.entries.new(params[:entry]) # <-- Scope to the current user
    
        respond_to do |format|
          if @entry.save
            format.html { redirect_to(@entry, :notice => 'Entry was successfully created.') }
            format.xml  { render :xml => @entry, :status => :created, :location => @entry }
          else
            format.html { render :action => "new" }
            format.xml  { render :xml => @entry.errors, :status => :unprocessable_entity }
          end
        end    
      end
    

    【讨论】:

    • 另外,您需要对编辑操作执行相同的操作。 @entry = current_user.entries.find(params[:id]) 这样一个用户就不能编辑另一个用户的条目。
    • 好吧!谢谢。 :) 你能给我多解释一下吗?就像我说的,我是新手——我不太明白你所说的 scope to 是什么意思...
    • Entry.find(params[:id]) 可以在您的数据库中找到任何条目记录,但通常您希望用户只访问属于他们的记录。在您上面的编辑操作中,任何用户如果知道(或猜到)id 就可以编辑任何条目。通常的做法是通过将查找限制为仅返回属于当前用户的条目来防止此问题。 current_user.entries.find(params[:id]) 就是通过向 SQL 查询中添加 WHERE 条件来做到这一点的,例如 WHERE entries.user_id=123
    猜你喜欢
    • 1970-01-01
    • 1970-01-01
    • 2021-10-22
    • 1970-01-01
    • 1970-01-01
    • 2017-10-21
    • 2023-03-07
    • 1970-01-01
    • 1970-01-01
    相关资源
    最近更新 更多