Have Geek Brain

Access restriction in ERB code

I am trying to create a CMS using ERB. Is there a way to provide read-only ERB code to your models? For example, I want to be able to load any information about my models (Model.all, Model.find_by_slug, Model.find_by_name, Model.other_model.name, etc.), but I don't want to be able to change this data. Can you disable ERB from executing commands that will make database changes (Model.save, Model.update, Model.delete, Model.destroy, etc.) ???

+2


a source to share


3 answers


Take a picture: http://www.liquidmarkup.org/



+1


a source


There is safemode by Rails developer Raven Sven Fuchs to make you erb, well, safer.



A templating engine like fluid (which is painful in my eyes) or mustache may be easier to learn and apply for your users than erb.

0


a source


Try using: readonly flag when searching for models:

@posts = Post.find(:all, :readonly => true)

In case you try to save it, a ReadOnlyRecord exception will be thrown. But I also suggest Liquid as a templater, since the user has no limited access to the kinds of applications inside ERB templates.

0


a source






More articles:


All Articles