mx3/mx — Issue #49: Before (after?) filter check that Model#proj_id matches Proj#id
Author: mjy
Created: 2012-02-27 17:30:38+00:00
State: open
Labels: tasks

No point in hiding this, better to get it out there and take a stab at resolving the issue.

The basic problem- there is no check to see if the Instance denoted by an id matches the proj_id in the request.

For example, if we have an Otu with proj_id = 1 and id = 1 we can view it like this: `/projects/2/otus/1`, when it should only be `/projects/1/otus/1`.

I'm not sure how to best resolve this, it's clearly a controller level problem. We might make all our controllers inherit some code? If we could at minimum create for the CRUD methods we might solve most of the problems.

It might take a serious rethinking of how presently do things. You'll see that we assign @proj on every call, and use it determine that a user has access to a site. It might mean we just include a line of code in every controller that is like 'validate_membership(@otu) or validate_membership(@specimen, @proj)', but that doesn't seem to DRY.