Re: Best Practise: Protecting against unallowed save()

On Sat, Mar 28, 2009 at 12:07 PM, Aurelius <aurelius@temporaryinbox.com> wrote:
>
> That works only if the model is DIRECTLY associated with Users, but
> not e.g. here:
>
> User hasMany Blogs hasMany Entries
>
> I can't believe theres no standard-function for this, isn't is one of
> the normallest things,
> that there can be User, which have stuff to edit, but ONLY there one
> (=99% of big websites)

public function edit()
{
if (!empty($this->data))
{
// ...
}

if (empty($this->data))
{
$filters = array(
'conditions' => array(
'Whatever.user_id' => $this->Auth->user('id')
)
);
$this->data = $this->Whatever->find('first', $filters);
}
}

As I said, use the SecurityComponent to ensure that your hidden fields
are not adjusted by the user.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "CakePHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to cake-php+unsubscribe@googlegroups.com
For more options, visit this group at http://groups.google.com/group/cake-php?hl=en
-~----------~----~----~----~------~----~------~--~---