title: how to prevent users from accessing inbox messages
body: <p>I have been working on this custom inbox messaging. I am trying to setup so that only the inbox owner (user logged in) can view their messages. Right now anyone can type in a url such as <code>/users/1/messages/7</code> and view the message when it should only be readable by User wih id 1, not Users with ids 4, 5, 6, etc. I'm assuming I need to go in the messages model and add something like:</p>
  
  <pre><code>if inbox.recepient_id != @current_user.id
  redirect_to :root
  </code></pre>
  
  <p>Any idea how to get this to work?</p>
  
  <p>messages model:</p>
  
  <pre><code>class Message &lt; ActiveRecord::Base
     attr_accessible :subject, :body, :sender_id, :recepient_id, :read_at,:sender_deleted,:recepient_deleted
     validates_presence_of :subject, :message =&gt; "Please enter message title"
  
     belongs_to :sender, :class_name =&gt; 'User', :foreign_key =&gt; 'sender_id'
     belongs_to :recepient, :class_name =&gt; 'User', :foreign_key =&gt; 'recepient_id'
  
     # marks a message as deleted by either the sender or the recepient, which ever the user that was passed is.
     # When both sender and recepient marks it deleted, it is destroyed.
     def mark_message_deleted(id,user_id)
        self.sender_deleted = true if self.sender_id == user_id
        self.recepient_deleted = true if self.recepient_id == user_id
        (self.sender_deleted &amp;&amp; self.recepient_deleted) ? self.destroy : self.save!
     end
     # Read message and if it is read by recepient then mark it is read
     def readingmessage
        self.read_at ||= Time.now
        save
     end
  
    # Based on if a message has been read by it's recepient returns true or false.
    def read?
        self.read_at.nil? ? false : true
    end
  
    def self.received_by(user)
       where(:recepient_id =&gt; user.id)
    end
  
    def self.not_recepient_deleted
       where("recepient_deleted = ?", false)
    end
  end
  </code></pre>