【问题标题】:Devise strong parameter sanitizer设计强大的参数消毒剂
【发布时间】:2013-12-01 04:47:02
【问题描述】:

我正在尝试在使用 devise 时自定义我的输入参数。在我的能力范围内,我已经关注了devise doc 的主题。我还广泛搜索了一些有用的文章,例如this one。最后,当我填写表单并点击提交时,会返回新用户页面上的“sign_up”表单。当我在控制台中检查数据库时,没有添加新用户,下面列出了服务器日志和相关代码。如果您想查看任何其他代码,请告诉我并更新问题。非常感谢任何和所有帮助。

服务器日志:

Started GET "/users/sign_up
utf8=%E2%9C%93&authenticity_token=lnKi02OIXc3sSkCpCzKmvQ6iaSZPI6s9aVxN9pCavH8%3D&user%5Bemail%5D=kit%40kit.com&user%5Bhandle%5D=kit&user%5Bpassword%5D=[FILTERED]&user%5Bpassword_confirmation%5D=[FILTERED]&commit=Sign+Up" for 127.0.0.1 at 2013-11-17 21:01:31 -0800
Processing by Devise::RegistrationsController#new as HTML
Parameters: {"utf8"=>"✓",  "authenticity_token"=>"lnKi02OIXc3sSkCpCzKmvQ6iaSZPI6s9aVxN9pCavH8=", "user"=>{"email"=>"kit@kit.com", "handle"=>"kit", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Sign Up"}
Rendered devise/shared/_links.erb (0.3ms)
Rendered devise/registrations/new.html.erb within layouts/application (3.7ms)
Completed 200 OK in 10ms (Views: 9.0ms | ActiveRecord: 0.0ms)

我的应用程序控制器:

class ApplicationController < ActionController::Base
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
 protect_from_forgery with: :exception


 protected

 def devise_parameter_sanitizer
    if resource_class == User
      User::ParameterSanitizer.new(User, :user, params)
    else
      super # Use the default one
    end
 end
end

User_sanitizer:

class User::ParameterSanitizer < Devise::ParameterSanitizer

private
def account_sign_in
    default_paramiters.permit(:first_name, :last_name, :handle, :email, :password, :password_confirmation, :current_password) 
end

def account_sign_up
    default_paramiters.permit(:first_name, :last_name, :handle, :email, :password, :password_confirmation, :current_password) 
end

def account_account_update
    default_paramiters.permit(:first_name, :last_name, :handle, :email, :password, :password_confirmation, :current_password) 
end
end

application.html.erb

<!DOCTYPE html>
<html>
<head>
  <title>Meowit</title>
  <%= stylesheet_link_tag    "application", media: "all", "data-turbolinks-track" => true %>
  <%= javascript_include_tag "application", "data-turbolinks-track" => true %>
  <%= csrf_meta_tags %>
</head>
<body>


<nav class="navbar navbar-default" role="navigation">
  <!-- Brand and toggle get grouped for better mobile display -->
  <div class="navbar-header">
    <button type="button" class="navbar-toggle" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1">
      <span class="sr-only">Toggle navigation</span>
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
    </button>
    <a class="navbar-brand" href="<%= root_path %>">MeowIT</a>
  </div>

  <!-- Collect the nav links, forms, and other content for toggling -->
  <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1">
    <ul class="nav navbar-nav">
        <li><a href="<%= meows_path %>">Feed</a></li>



    </ul>
    <ul class="nav navbar-nav navbar-right">
        <li>

        <% if user_signed_in? %>
            <li class="dropdown">
        <a href="" class="dropdown-toggle" data-toggle="dropdown">Account<b class="caret"></b></a>
        <ul class="dropdown-menu">
          <li><%= "#{current_user.email}" %></li>
          <li><%= link_to "Edit", edit_user_registration_path %></li>
          <li><%= link_to("Logout", destroy_user_session_path, :method => :delete) %></li>
        </ul>
      </li>
        <% else %>
            <li><%= link_to("Login  ", new_user_session_path) %></li>
        <% end %>

  </div><!-- /.navbar-collapse -->
</nav>

  <% if flash[:success] %>
    <div class='alert alert-success'>
      <%= flash[:success] %>
    </div>
  <% end %>

  <% if flash[:info] %>
    <div class='alert alert-info'>
      <%= flash[:info] %>
    </div>
  <% end %>

  <% if flash[:warning] %>
    <div class='alert alert-warning'>
      <%= flash[:warning] %>
    </div>
  <% end %>

  <% if flash[:danger] %>
    <div class='alert alert-danger'>
      <%= flash[:danger] %>
    </div>
  <% end %>


    <div class="container">

      <%= yield %>
    </div>
  </body>
</html>

sanitizers.rb:

require "#{Rails.application.root}/lib/user_sanitizer.rb"

new.html.erb(内部视图/设计/注册):

<div class="row">
  <div class="col-lg-6">
    <div class="well">
      <form class="bs-example form-horizontal">
        <fieldset>
        <legend>Sign Up</legend>
        <%= simple_form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
          <%= f.error_notification %>


              <%= f.label :Email, class: "col-lg-2 control-label" %>
              <div class="col-lg-10">
                <%= f.text_field :email, :required => true, :autofocus => true, class: "form-control" %>
              </div>

                  <br>
                  <br>
                  <br>

              <%= f.label :"Name", class: "col-lg-2 control-label" %>
              <div class="col-lg-10">
                <%= f.text_field :handle, :required => false, class: "form-control" %>
              </div>


                  <br>
                  <br>
                  <br>

              <%= f.label :Password, class: "col-lg-2 control-label" %>
              <div class="col-lg-10">
                <%= f.password_field :password, :required => true, class: "form-control" %>
              </div>


                  <br>
                  <br>
                  <br>

              <%= f.label :"Password Confirmation", class: "col-lg-2 control-label" %>
              <div class="col-lg-10">
                  <%= f.password_field :password_confirmation, :required => true, class: "form-control" %>
              </div>

                  <br>
                  <br>

              <div class="col-lg-10 col-lg-offset-2">
                <%= f.button :submit, "Sign Up", class: "btn btn-primary" %>
              </div>

        <% end %>


        </fieldset>
      </form>
    </div>
  </div>
</div>

        <%= render "devise/shared/links" %>

编辑(1)

创建新文件 app/controllers 中的registrations_controller.rb 类 RegistrationsController

      private

        def configure_devise_params
          devise_parameter_sanitizer.for(:sign_up) do |u|
            u.permit(:email, :password, :password_confirmation)
          end
        end
    end 

修改了 routes.rb 中的 devies_for 路由以指向新的控制器。

  devise_for :users, :controllers => {:registrations => "registrations"}

最后,我在应用程序控制器中注释掉了对 devise_parameter_sanitizer 的引用并删除了

    require "#{Rails.application.root}/lib/user_sanitizer.rb"

在 sanitizers.rb 中

【问题讨论】:

    标签: ruby-on-rails devise strong-parameters


    【解决方案1】:

    不确定您是否仍需要帮助,但我可以通过删除前缀帐户来让我的消毒剂正常工作。

    在你的 user_sanitizer.rb 中从你的方法中删除“帐户”。

    def sign_in
        ...
    end  
    
    def sign_up
        ...
    end  
    

    这样做对我有用。

    【讨论】:

      【解决方案2】:

      你可以添加这个来设计注册控制器

      private
      
      def configure_devise_params
        devise_parameter_sanitizer.for(:sign_up) do |u|
          u.permit(:email, :password, :password_confirmation)
        end
      end
      

      【讨论】:

      • 我试图在 user_sanitizer.rb 中做基本相同的事情,要求它通过 sanitizers.rb。结果相同但没有WARNING: Can't mass-assign protected attributes 我想我还缺少其他东西。请参阅问题中的编辑(1),看看我是如何实现上述内容的。
      猜你喜欢
      • 1970-01-01
      • 1970-01-01
      • 1970-01-01
      • 1970-01-01
      • 1970-01-01
      • 1970-01-01
      • 2021-03-06
      • 1970-01-01
      • 1970-01-01
      相关资源
      最近更新 更多