Don’t trust primary key parameters

By default Ruby on Rails URLs have the following format: http://www.domain.com/project/show/1, whereas "show" is the action to be performed and "1" is the project id, which is the primary key of the project table (i.e. a project's main identifier is the id, but it could be something else, such as the name). It will be used in the controller to load the project with the id 1 and present it to the user in some form or another.

You have to keep in mind that a user access control may hinder unauthorized people to log in to the application. But if you want to prevent users from viewing or altering certain information, you will have to take additional precautions. For example, even though you don't have a link in your application to show the project with the id 2, you cannot hinder the user from entering the URL http://www.domain.com/ project/show/2. That means you have to check permissions every time someone wants to access an object, for example by verifying ownership:

# find the project with the id from the
# URL which is owned by the logged in user

@project = Project.find(params[:id], :conditions => \\
   ["user_id = ?", session[:user_id]]

Also, the Rails Way has a good post on this:

http://www.therailsway.com/2007/3/26/association-proxies-are-your-friend

Comments

[Dan Kubb]

I would say that in most cases if you are using find directly on a class, and not a proxy, that its a security issue waiting to happen.

The only exception to this might be common lookup tables like countries, timezones or currencies. For all other data access use proxies and otherwise you'll be more likely to show data meant for one user to another.

In your example above I'd probably create a method in ApplicationController called current_user that instantiated a User object from the user_id in the session. Then it would just be a matter of doing @project = current_user.projects.find(params[:id) assuming there was a has_many association between User and Project. I believe this is the pattern they recommend on the Rails Way blog.

[Tramadol ultram and acute pain]

Brand ultram order ultram tramadol pain medicine. Tramadol ultram and acute pain. Ultram tramadol....

[Bdsm toon.]

Bdsm toon....

[adult all-inclusive resort]

Don’t trust primary key parameters...