logo
down
shadow

How to properly set up the admin role in my app


How to properly set up the admin role in my app

Content Index :

How to properly set up the admin role in my app
Tag : ruby-on-rails , By : Puneet Madaan
Date : December 01 2020, 05:00 PM

it should still fix some issue Your approach of add an administrator to your app is not very functional, what if you need to add more roles?
My suggestion is to use a gem for your roles like Rolify, with Rolify you can create any role, and use a gem for allow and deny perms like Cancancan
user = User.find(1)
user.add_role :admin
#app/models/ability.rb
class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user (not logged in)
    if user.has_role? :admin
       can :manage, :all
    else
       can :read, :all
    end
  end
end
#In your application_controller.rb
rescue_from CanCan::AccessDenied do |exception|
    if exception.message.match(/are not/i)
        redirect_to root_path, :alert => "Oouch... no estás autorizado para acceder a esta página"
    else
        redirect_to root_path, :alert => exception.message
    end
 end

Comments
No Comments Right Now !

Boards Message :
You Must Login Or Sign Up to Add Your Comments .

Share : facebook icon twitter icon

request.isUserInRole("ADMIN") also returns true for user not in role ADMIN but role USER


Tag : security , By : beng
Date : March 29 2020, 07:55 AM
this one helps. Fixed it by making sure the Realm setting "Assign Groups" is empty. Glassfish will load them from the Group Table.

MODx - Editor role can't see files uploaded by Admin role


Tag : development , By : WuJanJai
Date : March 29 2020, 07:55 AM
This might help you No worries I found it, I had to add pdf to allowed file types in the user manager.

Deny user with manager role to edit users with admin role Asp.Net MVC5 Identity


Tag : asp.net-mvc , By : dlouzan
Date : March 29 2020, 07:55 AM
Does that help Move the indicated section of code to the Edit method inside the if(!isAdmin):
    if (!isAdmin)
    {      
        if (editUser.Roles.Exists(x => x.RoleName == "Admin" && x.Checked))
        {
            return RedirectToAction("AccessNotAllowed", "Errors");
        }
        var adm = editUser.Roles
                    .Where(x => x.RoleName.Equals("Admin", StringComparison.OrdinalIgnoreCase))
                    .FirstOrDefault();
        if (adm != null)
        {
            editUser.Roles.Remove(adm);
        }
    }

Creating a security role to be able to only create roles and users without having system admin role


Tag : development , By : Heals1ic
Date : March 29 2020, 07:55 AM
seems to work fine No, this is not that simple. User cannot give another user privilege higher than he has (it would be a serious security hole). So for example you have role to edit Security roles and you have Read access for Accounts in your Business Units. If somebody in your Business unit has no Read access and only User access, you can add him Read access for Business Unit (the same you have), but you will not be able to give him Organizational access (so higher than yours). You could imagine that if this would be possible, you will be able to basically give yourself Admin privilege and do whatever you want in CRM. Knowing that, it should be possible for you to create a role that for example have full access to Accounts, Contacts, Custom entities etc. and Security Roles. This role would be able to modify other users access levels to Accounts, Contacts etc. but no other entities that they don't have privilege to.
Exactly the same logic applies to assigning the Security Roles. So user A cannot assign a Security Role to user B, if it gives user B privileges higher than has User A.

Admin role global filter with Role and AllowAnonymous overrides?


Tag : asp.net-mvc-3 , By : Thomas Gueze
Date : March 29 2020, 07:55 AM
Related Posts Related QUESTIONS :
  • Pass variable from Devise controller to custom mailer?
  • How to pass formdata in swagger with require ruby on rails
  • How can i resolve this- rake:aborted! Mysql2::Error: Access denied for user 'root'@'localhost' (using password: NO)
  • random ActionController::InvalidAuthenticityToken in my rails app
  • How to determine which controller has been called from ApplicationController?
  • Parameterize an ActiveRecord #joins method
  • Why the redis returning more values instead of count?
  • Is this ruby(rails) code readable simply?
  • Can I see what SQL an ActiveRecord .save call would generate, without doing the save?
  • Time.current.tap{|t| t.change hour: 10 } is not working in Rails 4.2
  • Write active decorator DRY
  • Creating 2 Models in Controller Action With Transaction - Rails 4
  • How do I display the text with all of the tabs and new lines (\t and \n) in Ruby on Rails?
  • Why my Module is not being loaded in Rails?
  • how to retrieve data from the database using the has_many association
  • Out of ranger error, Type::Integer during rspec test
  • Generate a video from many images using RMagick in RoR
  • Calling an overriden scope from an included concern in the overriding scope
  • ActionController::UnknownFormat on Bugsnag
  • How do I pass a person object into a related Post model object
  • rubocop cannot load such file -- rubocop-rails
  • Malicious Bots waking up heroku free app and using up all dyno hours
  • How to do RSpec of validators?
  • Is there a way to wrap the response of all controller methods in a json object in application_controller.rb?
  • Need to implement #cache! if you want to use Cloudinary::CarrierWave::Storage as a cache storage
  • How to integrate custom bootstrap theme in activeadmin
  • How can I load an STI record using just the base STI class?
  • Getting the .each loop result with the lowest number from json
  • When and where to aggregate or perform calculations on data in RESTful Rails API
  • How do you write a conditional ternary operator inline in Ruby on Rails?
  • Why put require statement at the end of a ruby file?
  • In Rails, is it possible to display an alert without calling redirect_to or render?
  • Convert hash of hash in array of hash
  • Rails 5 tries to save the empty string as nil
  • websocket-driver was not found on deploy
  • Dangerous query method deprecation warning on Rails 5.2.3
  • Using ERB in Markdown with Redcarpet
  • How to create list of unique array items from thousands of records in Rails?
  • Undefined method 'suspend_paypal' for User
  • Any good methods to find Ruby on Rails memory leak?
  • Why does if __FILE__ == $0 not work on Heroku with Rails 5.2?
  • Rails: How to implement login and authentication where i have five different user models in rails?
  • What is the impact of changing rails secret_key_base on production?
  • how to keep heroku dyno worker alive if web dyno goes to sleep?
  • syntax error, unexpected end-of-input, expecting keyword_end. when running rspec of feature file
  • How does form_with know which method to call inside a model?
  • When using activestorage in Rails 6, how do I retain a file when redisplaying a form?
  • How to override table column value with column value from second table if it exist?
  • Comparison of !! operator vs present?
  • Error parsing Gemfile when pushing to Heroku
  • Rails 5: How to save uniq element in Array of Hash get from API's response
  • Devise: Unable to redirect to current user edit profile after sign_up
  • How to fix "fatal :unable to look up https (port 9418) (No such host is known)
  • How do I create a self-referential association table rails migration
  • How to send a variable from an action without using the URL in Rails?
  • How to use Ruby on Rails functions within plain (non ROR) Ruby file
  • Rails 6 and Google Maps for Rails
  • Ruby .map hash values to key value pair in array
  • Rails Frontend, Backend, and API
  • How to make value attribute in the select option tag to have url's in rails
  • shadow
    Privacy Policy - Terms - Contact Us © scrbit.com