title: Restricting url manipulation to return other user records
body: <p>I have just begun Rails 3. I have generated the below code using the scaffold from Rails 3 on a table called "Logs". </p>
  
  <p>The 'index' function below provides only the records associated with the current_user.id (from the session stored in the session table). The users records are only presented with the following route logged in as user = 3 (see index code below)</p>
  
  <blockquote>
    <p>localhost:3000/logs</p>
  </blockquote>
  
  <p><strong>Problem:</strong> As a user, I can view a record which is not my record (being user=3) by editing the url manually to show any other record:</p>
  
  <blockquote>
    <p>localhost:3000/logs/5            'this was entered by user.id=2'</p>
  </blockquote>
  
  <p><strong>Seeking Solution</strong>: How do I prevent manually hacking of the url to prevent a user viewing other user records?</p>
  
  <blockquote>
    <p>class LogsController &lt; ApplicationController</p>
    
    <p>before_filter :login_required</p>
  
  <pre><code>def index 
    @logs = Log.where(:user_id =&gt; current_user)
    respond_to do |format|
    format.html # index.html.erb
    format.xml  { render :xml =&gt; @logs }
  end
  </code></pre>
  </blockquote>
  
  <p>Please ignore that the new function is missing from the create function below. The code below is to merely demonstrate how I put the user_id into the "Logs" table</p>
  
  <blockquote>
  <pre><code>def create
   @log = Log.new(params[:log])
   @log.user_id = current_user.id
    respond_to do |format|
    if @log.save
      format.html { redirect_to(@log)}
      format.xml  { render :xml =&gt; @log, :status =&gt; :created, :location =&gt; @log }
    else
      format.html { render :action =&gt; "new" }
      format.xml  { render :xml =&gt; @log.errors, :status =&gt; :unprocessable_entity }
    end
  end
  </code></pre>
  </blockquote>