3 ms·

That's super helpful and thank you for the very kind and welcoming way you delivered that feedback. I wish more HN comments were this nice. It takes longer to w

That's super helpful and thank you for the very kind and welcoming way you delivered that feedback. I wish more HN comments were this nice. It takes longer to write but is more likely to be implemented. edit - Made the update! Sorry anyone who went to the site when it was down for 20 seconds prev edit - ans -> and

jlogsdon 13y ago
Check out CanCan[1] for authorization. It's pretty simple to get started with, but provides a lot of power for controlling who can access what. [1] https://github.com/ryanb/cancan https://github.com/ryanb/cancan
- alinajaf 13y ago
  Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan. This won't take care of the parameter whitelisting for you though.
mikeyouse 13y ago
Chrome v28.0.1500.6 dev on a MBP is rendering the page a little strange: http://i.imgur.com/KfKFGjd.png http://i.imgur.com/KfKFGjd.png I assume 1, 2, and 3 are supposed to be on the same line?
- jasonshen 13y ago
  Oh weird. Yeah, they are 3 divs that are supposed to take up 33% of the width until they collapse ontop of each other as the screen shrinks. That shouldn't happen - will try to reproduce and fix.
alinajaf 13y ago
FYI it looks like you've fixed the update controller (as per the gist), but I can still: * See other peoples rewards (just go to /rewards/whatever-id), not that big a deal, unless you want to keep them private. * Go to the edit form of any reward (just go to /rewards/whatever-id/edit), big-deal factor is same as above. * Delete other peoples rewards (inspect the delete link of any reward in chrome, modify the id in the href, then click it), this is somewhat of a big deal. Sorry to whoever had reward with id 4! PITA I know, security doesn't get easier I'm afraid :) EDIT: updated gist to be a little more useful, though you probably worked the required code out for yourself.
deleted 13y ago
[deleted]

jlogsdon 13y ago

Check out CanCan[1] for authorization. It's pretty simple to get started with, but provides a lot of power for controlling who can access what. [1] https://github.com/ryanb/cancan https://github.com/ryanb/cancan

alinajaf 13y ago
Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan. This won't take care of the parameter whitelisting for you though.

mikeyouse 13y ago

Chrome v28.0.1500.6 dev on a MBP is rendering the page a little strange: http://i.imgur.com/KfKFGjd.png http://i.imgur.com/KfKFGjd.png I assume 1, 2, and 3 are supposed to be on the same line?

jasonshen 13y ago
Oh weird. Yeah, they are 3 divs that are supposed to take up 33% of the width until they collapse ontop of each other as the screen shrinks. That shouldn't happen - will try to reproduce and fix.

alinajaf 13y ago

FYI it looks like you've fixed the update controller (as per the gist), but I can still: * See other peoples rewards (just go to /rewards/whatever-id), not that big a deal, unless you want to keep them private. * Go to the edit form of any reward (just go to /rewards/whatever-id/edit), big-deal factor is same as above. * Delete other peoples rewards (inspect the delete link of any reward in chrome, modify the id in the href, then click it), this is somewhat of a big deal. Sorry to whoever had reward with id 4! PITA I know, security doesn't get easier I'm afraid :) EDIT: updated gist to be a little more useful, though you probably worked the required code out for yourself.

deleted 13y ago

[deleted]