Go to file
Will Bradley d283d0a237 Update README.rdoc 2013-06-28 01:29:29 -04:00
app Update readme 2013-06-28 01:27:08 -04:00
config Initial commit 2013-06-28 01:22:16 -04:00
db Initial commit 2013-06-28 01:22:16 -04:00
doc Initial commit 2013-06-28 01:22:16 -04:00
lib Initial commit 2013-06-28 01:22:16 -04:00
log Initial commit 2013-06-28 01:22:16 -04:00
public Initial commit 2013-06-28 01:22:16 -04:00
script Initial commit 2013-06-28 01:22:16 -04:00
test Initial commit 2013-06-28 01:22:16 -04:00
vendor Initial commit 2013-06-28 01:22:16 -04:00
.gitignore Initial commit 2013-06-28 01:22:16 -04:00
Gemfile Initial commit 2013-06-28 01:22:16 -04:00
Gemfile.lock Initial commit 2013-06-28 01:22:16 -04:00
README.rdoc Update README.rdoc 2013-06-28 01:29:29 -04:00
Rakefile Initial commit 2013-06-28 01:22:16 -04:00
config.ru Initial commit 2013-06-28 01:22:16 -04:00

README.rdoc

== Cancan should automatically protect updates just like it protects create

To reproduce:

* rake db:migrate
* rails server
* http://localhost:3000/posts
* Create a new post with a User ID of 5
  *  Note this is prohibited by cancan
* Create a new post with a nil User ID
  * Note this is allowed by cancan (you aren't signed in, your user_id is nil)
* Edit your post, and set the User ID to 5
  * Note this succeeds
* Edit app/controllers/posts_controller.rb on line 6, uncomment the before_filter line and save
* Create a new post with a nil User ID
  * Edit the post and set the User ID to 5
  * Note the problem is now fixed, guest users cannot create or update posts that don't belong to them.