Railsで簡単な掲示板アプリを作成しています。
localhost:3000/projects/2/tasks/1のようにURLを入力すると、projectに紐づいていないTaskの詳細情報が確認できてしまうことが分かりました。
URL直打ちで詳細画面へ行かない様にしたいのですが、どの様にすれば良いか分からず詰まっております。
class TasksController < ApplicationController before_action :set_project before_action :set_task, only: %i[show edit update destroy] def index @tasks = @project.tasks end def show; end def new @task = Task.new end def edit; end def create @task = Task.new(task_params) if @task.save redirect_to [@project, @task], notice: 'Task was successfully created.' else render :new end end def update if @task.update(task_params) redirect_to [@project, @task], notice: 'Task was successfully updated.' else render :edit end end def destroy @task.destroy redirect_to project_tasks_url, notice: 'Task was successfully destroyed.' end private def set_project @project = Project.find(params[:project_id]) end def set_task binding.pry @task = Task.find(params[:id]) end def task_params params.require(:task).permit(:title, :status, :deadline, :completion_date, :description).merge(project_id: params[:project_id]) end end
show
1<p id="notice"><%= notice %></p> 2<p> 3 <strong>Title:</strong> 4 <%= @task.title %> 5</p> 6<p> 7 <strong>Status:</strong> 8 <%= @task.status %> 9</p> 10<p> 11 <strong>Deadline:</strong> 12 <%= @task.deadline.strftime('%Y-%m-%d %H:%M') if @task.deadline? %> 13</p> 14<p> 15 <strong>Completion date:</strong> 16 <%= @task.completion_date %> 17</p> 18<p> 19 <strong>Description:</strong> 20 <%= @task.description %> 21</p> 22<%= link_to 'Edit', edit_project_task_path(@task.project_id, @task) %> | 23<%= link_to 'Back', project_tasks_path %>