```ruby
require_dependency "cfp/application_controller"

module Cfp
  class ProposalsController < ApplicationController
    before_filter :load_proposal, :only => [:edit, :update, :destroy]

    def index
      @proposals = Proposal.scoped_for(current_user)
    end

    def new
      @proposal = Proposal.new
    end

    def create
      @proposal = Proposal.new proposal_params[:proposal]
      @proposal.user = current_user
      if @proposal.save
        redirect_to :proposals, :notice => t('proposals.created.success')
      else
        render :action => :new
      end
    end

    def edit
    end

    def update
      if @proposal.update_attributes(proposal_params[:proposal])
        redirect_to :proposals, :notice => t('proposals.edited.success')
      else
        render :action => "edit"
      end
    end

    def destroy
      @proposal.destroy
      redirect_to :proposals, :notice => t('proposals.deleted.success')
    end

    private
    def load_proposal
      @proposal = Proposal.find(params[:id])
    end

    def proposal_params
      params
    end
  end
end
```

Make sure that only the people that are supposed to edit and destroy proposals do so
user
```ruby
require_dependency "cfp/application_controller"

module Cfp
  class ProposalsController < ApplicationController
    before_filter :load_proposal, :only => [:edit, :update, :destroy]

    def index
      @proposals = Proposal.scoped_for(current_user)
    end

    def new
      @proposal = Proposal.new
    end

    def create
      @proposal = Proposal.new proposal_params[:proposal]
      @proposal.user = current_user
      if @proposal.save
        redirect_to :proposals, :notice => t('proposals.created.success')
      else
        render :action => :new
      end
    end

    def edit
    end

    def update
      if @proposal.can_be_edited_by?(current_user) && @proposal.update_attributes(proposal_params[:proposal])
        redirect_to :proposals, :notice => t('proposals.edited.success')
      else
        render :action => "edit"
      end
    end

    def destroy
      @proposal.destroy if @proposal.can_be_edited_by?(current_user)
      redirect_to :proposals, :notice => t('proposals.deleted.success')
    end

    private
    def load_proposal
      @proposal = Proposal.find(params[:id])
    end

    def proposal_params
      params
    end
  end
end
```
assistant