Upgrade to Rails 4
User permission control

In Product page