Protecting upload

Before protecting uploading, we need to add the association between the user and the albums/photos.

Execute the following migration generation commands and migrate the database.

$ rails generate migration AddUserIdToAlbum user_id:integer
$ rails generate migration AddUserIdToPhoto user_id:integer
$ rake db:migrate
==  AddUserIdToAlbum: migrating ===========================
-- add_column(:albums, :user_id, :integer)
   -> 0.0016s
==  AddUserIdToAlbum: migrated (0.0018s) ==================

==  AddUserIdToPhoto: migrating ===========================
-- add_column(:photos, :user_id, :integer)
   -> 0.0009s
==  AddUserIdToPhoto: migrated (0.0011s) ==================

Then add belongs_to :user to both album.rb class and photo.rb class.

And the following to user.rb class.

has_many :photos
has_many :albums

Next, we would like to protect user upload in the photos controller.

before_filter :authenticate_user, only: [:new, :edit]

def authenticate_user
  redirect_to new_user_session_url unless user_signed_in? and !@album.user.nil? and current_user == @album.user
end

And we add the user association @photo.user = current_user in the create method.

 def create
   @photo = @album.photos.new params[:photo]
   @photo.user = current_user
   if @photo.save
     redirect_to @album
   else
     render :new
   end
 end

Now when we go to any photo upload URL without logged in to the album owner, we will be redirected to the sign_in page.

Then we apply the same to the albums controller.

In the albums_controller file.

before_filter :authenticate_user, only: [:new]

def authenticate_user
  redirect_to new_user_session_url unless user_signed_in?
end

And the user-albums association in the create method.

 def create
   @album = Album.new params[:album]
   @album.user = current_user
   if @album.save
     redirect_to @album
   else
     render :new
   end
 end

Note: If both `authenticate_user` share the same logic, we can further extract it into their common parent class — application_controller.

It’s time to test the function in web browser.

We can create albums and upload photos as normal after we logged in. Now try to create another user account and access the album you just created, you should not be able to upload any new photos.

The view

One last thing, we don’t want the upload photo or edit link appears on the photo that isn’t belonged to the current user.

In the views/photos/show.html.erb file.

<%- if user_signed_in? and current_user == @photo.user %>
  <%= link_to 'Edit', edit_album_photo_path(@album, @photo) %>
<%- end %>

And the views/albums/show.html.erb file.

<%- if user_signed_in? and current_user == @album.user %>
  <p><%= link_to 'Upload new photo', new_album_photo_path(@album) %></p>
<%- end %>

What’s next? We’re going to take a look at “Challenges”.