77c043b68a
This way it won't be possible to browse all user URLs by just going to /users/1, /users/2, /users/3, ... and collect usernames, which might not be desirable in some cases. Note we could use the username as a URL parameter and just find the user with `@user = User.find_by!(id: id, username: username)`, but since usernames might contain strange characters, this might lead to strange/ugly URLs. Finally, note we're using `username.to_s` in order to cover the case where the username is `nil` (as is the case with erased users).
22 lines
518 B
Ruby
22 lines
518 B
Ruby
class UsersController < ApplicationController
|
|
load_and_authorize_resource
|
|
before_action :check_slug
|
|
helper_method :valid_interests_access?
|
|
|
|
def show
|
|
raise CanCan::AccessDenied if params[:filter] == "follows" && !valid_interests_access?(@user)
|
|
end
|
|
|
|
private
|
|
|
|
def check_slug
|
|
slug = params[:id].split("-", 2)[1]
|
|
|
|
raise ActiveRecord::RecordNotFound unless @user.slug == slug.to_s
|
|
end
|
|
|
|
def valid_interests_access?(user)
|
|
user.public_interests || user == current_user
|
|
end
|
|
end
|