Hobo Hobo → Beyond Hobo 1.0

Comments and changes to this ticket

• 

  Tom Locke August 3rd, 2008 @ 10:46 AM

  • Title changed from “permission denied on web_method” to “When should web_method do the permission check?”
  • State changed from “new” to “open”
  • Tag changed from “question” to “model-controller, question, web-method”
  • Milestone set to “Hobo 1.0 - Final”

  It was designed this way deliberately so that security is built in, rather than something you have to remember.

  Having said that we should probably bring it into line with the other hobo actions, e.g. this would be the long way to do it (and this would give you the permission check).

  web_method :foo
  def foo
    hobo_web_method :foo do
      # permission check done, now call the method
      @this.foo
    end
  end
  

  Then the block form could be a shorthand for the above, e.g.

  web_method :foo do
    @this.foo
  end
  

  That way if you didn't want the permission check, you could use the def form and not call hobo_web_method.

  We could provide the same semantics for show_action and index_action.

• 

  Tom Locke March 12th, 2009 @ 01:41 PM

  • Milestone changed from “Hobo 1.0 - Final” to “Beyond Hobo 1.0”