diff --git a/source/projects/blogger.markdown b/source/projects/blogger.markdown index f21d2539f..e93f1338b 100644 --- a/source/projects/blogger.markdown +++ b/source/projects/blogger.markdown @@ -2461,13 +2461,13 @@ Then try to reach the registration form and it should work! Create yourself an ### Securing the Rest of the Application -The first thing we need to do is sprinkle `before_filters` on most of our controllers: +The first thing we need to do is sprinkle `before_actions` on most of our controllers: -* In `authors_controller`, add a before filter to protect the actions besides `new` and `create` like this:
`before_filter :require_login, except: [:new, :create]` +* In `authors_controller`, add a before filter to protect the actions besides `new` and `create` like this:
`before_action :require_login, except: [:new, :create]` * In `author_sessions_controller` all the methods need to be accessible to allow login and logout -* In `tags_controller`, we need to prevent unauthenticated users from deleting the tags, so we protect just `destroy`. Since this is only a single action we can use `:only` like this:
`before_filter :require_login, only: [:destroy]` -* In `comments_controller`, we never implemented `index` and `destroy`, but just in case we do let's allow unauthenticated users to only access `create`:
`before_filter :require_login, except: [:create]` -* In `articles_controller` authentication should be required for `new`, `create`, `edit`, `update` and `destroy`. Figure out how to write the before filter using either `:only` or `:except` +* In `tags_controller`, we need to prevent unauthenticated users from deleting the tags, so we protect just `destroy`. Since this is only a single action we can use `:only` like this:
`before_action :require_login, only: [:destroy]` +* In `comments_controller`, we never implemented `index` and `destroy`, but just in case we do let's allow unauthenticated users to only access `create`:
`before_action :require_login, except: [:create]` +* In `articles_controller` authentication should be required for `new`, `create`, `edit`, `update` and `destroy`. Figure out how to write the before action using either `:only` or `:except` Now our app is pretty secure, but we should hide all those edit, destroy, and new article links from unauthenticated users.