Rails - How To Destroy Users Created Under Devise? - ruby-on-rails

For my application, I have user accounts that people can sign up. I use the devise gem for the setup.
I also have a users page that lists out all the users registered to the site along with a destroy link. I want my administrator to be able to delete users and have it redirected to this users listing page. But when I click the link to destroy a specific user, it just redirects to the user profile page and does not delete the user from the database.
Does somebody know why?
**UPDATE: Updated code below as recommended and works now.
users_controller.rb
def destroy
#user = User.find(params[:id])
#user.destroy
if #user.destroy
redirect_to root_url, notice: "User deleted."
end
end
users/index.html.erb
<div class = "container">
<div id="usersview">
<b>USERS DIRECTORY</b>
<%= render #users %>
</div>
<center>
<%= will_paginate #users %>
</center>
</div>
users/_user.html.erb
<div class="comments">
<%= link_to user.name, user %>
<% if current_user.try(:admin?) && !current_user?(user) %>
<%= link_to "Destroy", admin_destroy_user_path(user), method: :delete, data: { confirm: "You sure?" } %>
<% end %>
</div>
routes.rb
devise_for :users
match 'users/:id' => 'users#destroy', :via => :delete, :as => :admin_destroy_user
match 'users/:id' => 'users#show', as: :user
resources :users

Devise doesn't provide this functionality out of the box. You have created your own destroy action, but you also have to create a custom route to that action.
In your routes:
match 'users/:id' => 'users#destroy', :via => :delete, :as => :admin_destroy_user
And then when creating the link:
<%= link_to "Destroy", admin_destroy_user_path(user), method: :delete, data: { confirm: "You sure?" } %>

According to devise 4.1 rake routes and views, using the following will help you delete the account once logged in as a user.
<%= link_to "Cancel my account", registration_path(current_user), data: { confirm: "Are you sure?" }, method: :delete %>

I think you have in your routes.rb: resources :users
The problem is that you are not passing the user that you want to delete when clicking:
users/_user.html.erb
<%= link_to "Destroy", user, method: :delete, data: { confirm: "You sure?" } %>
See that in second param I added user instead of user_url.
users_controller.rb
def destroy
#user = User.find(params[:id])
if #user.destroy
redirect_to root_url, notice: "User deleted."
end
end
In controller I removed an #user.destroy. You were calling it twice.
Hope it helps!

At least the latest version of Devise does provide such functionality out of the box, if a Devise-backed model has :registerable included.
class User < ApplicationRecord
devise :database_authenticatable, :registerable
end
Somewhere in app/views/layouts/application.html.erb:
<%= link_to 'Delete my account', user_registration_path, method: :delete if user_signed_in? %>

Or from rails c you can do something like this where "x" is user id.
user = User.where(id: x)
user.destroy(1)

Related

Add checkbox to edit bool value of user in devise in Rails

I have created a user using devise gem. I have added a column admin to the User table which has boolean value. Now what I need is to add checkboxes after every user in users_page and give a feature so that when the checkbox is checked the value of admin column changes to true. How can I add the functionality?
users_controller.rb
class UsersController < ApplicationController
def users_page
#users = User.all
end
def change_user_role
#user = User.find(params[:id])
format.html { redirect_to users, notice: 'Role changed successfully' }
end
def destroy
#user = User.find(params[:id])
#user.destroy
if #user.destroy
redirect_to root_url, notice: "User deleted."
end
end
end
users_page.html.erb
<h1>Users</h1>
<% #users.each do |user| %>
<h5><%= user.email %></h5>
<%= user.admin %>
<%= form_tag({controller: "users", action: "change_user_role"}, method: "get") do %>
<%= check_box_tag(:admin, checked: false) %>
<p><%= submit_tag 'Submit Answer' %></p>
<% end %>
<br>
<%= link_to "Destroy", admin_destroy_user_path(user), method: :delete, data: { confirm: "You sure?" } %>
<% end %>
routes.rb
Rails.application.routes.draw do
root to: 'pages#home'
get 'users/users_page'
devise_for :users
match 'users/:id' => 'users#destroy', :via => :delete, :as => :admin_destroy_user
get 'users#change_user_role'
end
Here I should submit the value of the checkbox in users_page to change_user_role and update the value in db and redirect it to users_page. How can I do that?
First of all, change your get method to put in your routes.rb because you'll be updating the resource in database:
Rails.application.routes.draw do
root to: 'pages#home'
get 'users/users_page'
devise_for :users
match 'users/:id' => 'users#destroy', :via => :delete, :as => :admin_destroy_user
// it will require user id in your url
resources :users do
member do
put :change_user_role
end
end
end
More on routes here
Then change your view to something like this:
<h1>Users</h1>
<% #users.each do |user| %>
<h5><%= user.email %></h5>
<%= form_for(user, url: change_user_role_user_path(user)) do |f| %>
<%= f.check_box(:admin) %>
<p><%= f.submit 'Submit Answer' %></p>
<% end %>
<br>
<%= link_to "Destroy", admin_destroy_user_path(user), method: :delete, data: { confirm: "You sure?" } %>
<% end %>
More on forms here
Your controller should look something like this:
class UsersController < ApplicationController
def users_page
#users = User.all
end
def change_user_role
#user = User.find(params[:id])
// if user is updated successfully then redirect
if(#user.update_attributes(user_params)
format.html { redirect_to users, notice: 'Role changed successfully' }
end
end
def destroy
#user = User.find(params[:id])
if #user.destroy
redirect_to root_url, notice: "User deleted."
end
end
// new method added to allow specific attributes only and discarding other malicious attributes that user may send
def user_params
params.require(:user).permit(:admin)
end
end
More on parameters here

recaptcha is not verifying -rails

Previously I was able to delete the user using an admin account, after I've added the recaptcha gem I was unable to do so.
I've tried the same method using recaptcha in adding a post and it works, but it doesn't work on delete.
users_controller.rb
def destroy
#user = User.find(params[:id])
if verify_recaptcha(model: #user) && #user.destroy
redirect_to #user
else
redirect_to posts_path
end
end
index.html.erb
<% #users.each do |user| %>
<td> <%= link_to "Delete", admin_destroy_user_path(user),
method: :delete, data: { confirm: "You sure?" },
:class => 'btn btn-danger' %>.
</td>
<% end %>
routes.rb
match 'users/:id' => 'users#destroy', :via => :delete, :as => :admin_destroy_user
Can you guys please help me to identify what seems to be the problem? Based on my understanding i think there's something wrong with the
if verify_recaptcha
because when i did something like !if verify_recaptcha && #user.destroy the user will be deleted and will show error message: reCAPTCHA verification failed, please try again. So i assume something is wrong with verifying the captcha

Want to edit/PUT/PATCH but error says "No route matches [POST]"

I'm building my second-ever basic Ruby on Rails application and having fun doing it, but have gotten stuck at precisely the same place that gave me trouble (and was never solved) on my last effort: the PUT or PATCH request.
My application has two models: entries and users. A logged-in user should be able to edit only those entries that were originally created by that user.
CONTROLLER
class EntriesController < ApplicationController
# authenticate user (Devise)
before_action :authenticate_user!, :except => [:index, :show]
# set entry upon page load
before_action :set_entry, :only => [:show, :edit, :update, :destroy]
# GET request - display all entries
def index
#all_entries = Entry.all
end
# GET request - display an individual entry
def show
# nothing required here because entry identified with before_action :set_entry on line 2 above
end
# GET request - access form to create a new entry
def new
#entry = Entry.new
#user = User.find(current_user[:id])
end
# GET request - access form to update an existing entry
def edit
if #entry[:user_id] != current_user[:id]
redirect_to root_path
else
redirect_to edit_entry_path
end
end
# POST request - make a new entry/save new data into db
def create
user = current_user[:id]
Entry.create({
entry_title: params[:entry][:entry_title],
book_title: params[:entry][:book_title],
text: params[:entry][:text],
img_url: params[:entry][:img_url],
tag: params[:entry][:tag],
created_at: params[:entry][:created_at],
user_id: user
})
redirect_to entries_path
end
# PUT request - save changes to an existing entry
def update
if #entry.update(entry_params)
redirect_to entry_path
else
render :new
end
end
# DELETE request - delete an existing entry from db
def destroy
#entry.destroy
redirect_to entries_path
end
private
def set_entry
#entry = Entry.find(params[:id])
end
def entry_params
params.require(:entry).permit(:email, :text, :tag)
end
end
VIEW (show.html.erb - shows a single entry and includes links allowing the logged-in user who originally authored the entry to edit or delete it)
<h3>Selected Entry</h3>
<div class="row">
<div class="col-md-2"></div>
<div class="col-md-6">
<div>Entry title: <%= #entry.entry_title %></div>
<div>Book title: <%= #entry.book_title %></div>
<div>Text: <%= #entry.text %></div>
</div>
<div class="col-md-4">
<div><%= #entry.created_at.strftime("%b %d, %Y") %></div>
<div>Submitted by: <i><%= #entry.user.email %></i></div>
<div>File under: <i><%= #entry.tag %></i></div>
<% if current_user %>
<%= link_to 'Edit', #entry, :method => 'update' %>
<%= link_to 'Delete', #entry, :method => 'delete' %>
<% end %>
</div>
</div>
ROUTES.RB - At first my routes were the commented-out lines, but then I had a thought that was either madness or sudden realization - should only the GET routes lead with "get"? So that's the non-commented-out attempt you see. Somehow the app works (except for the issue at hand) both ways.
In researching I've come across routes defined using a much more elaborate syntax than that I'm using here. I've been unable to figure out whether a given way of doing things is different convention, outdated, or just inadequate to the task.
Rails.application.routes.draw do
devise_for :users
resources :entries
# root 'entries#index'
# get '/entries' => 'entries#index'
# get '/users' => 'users#index'
# get '/entries/:id' => 'entries#show'
# get '/entries/:id' => 'entries#update'
# get '/entries/new' => 'entries#new'
# get '/entries/:id/edit' => 'entries#edit'
# get '/users/:id' => 'users#show'
# get '/about' => 'pages#index'
root 'entries#index'
get '/entries' => 'entries#index'
get '/entries/new' => 'entries#new'
post '/entries' => 'entries#create'
get '/entries/:id' => 'entries#show'
get '/entries/:id/edit' => 'entries#edit'
put '/entries/:id' => 'entries#update'
delete '/entries/:id' => 'entries#destroy'
get '/users' => 'users#index'
get '/users/:id' => 'users#show'
get '/about' => 'pages#index'
end
Thanks in advance for any insight. If additional context is needed I'm happy to provide.
Edited to add:
PARTIAL (_form.html.erb)
<div class="row">
<div class="col-md-2"></div>
<div class="col-md-6" id="form-container">
<%= form_for #entry do |form| %>
<br>
<%= form.text_field :entry_title, :size => 59, :placeholder => "Entry Title"%>
<br><br>
<%= form.text_field :book_title, :size => 59, :placeholder => "Book Title"%>
<br><br>
<%= form.text_field :img_url, :size => 59, :placeholder => "Image URL"%>
<br><br>
<%= form.text_area :text, :placeholder => "Text" %>
<br><br>
<%= form.text_field :tag, :placeholder => "Tag" %>
<br><br>
<%= form.submit %>
<% end %>
</div>
<div class="col-md-4"></div>
</div>
To edit a record you
first, should use a GET request to get the edit form
second, should submit that form using a PUT/PATCH request
To get to the edit form you should link to the edit path for your entry
<%= link_to 'Edit', edit_entry_path(#entry) %>
The Rails form helpers will automatically set the form to submit with the proper method, PUT OR PATCH.
:method in link_to helpers refers to HTML verb (get, post, etc), while controllers methods naming convention is action.
link_to
You need something as
<%= link_to 'Edit', #entry, :method => 'put' %>
or
<%= link_to 'Edit', #entry, :action => 'update' %>
At a glance you are trying to post with the edit link. Remember new/edit are get methods to render form, so just just delete method part in your links. Like from
<%= link_to 'Edit', #entry, :method => 'update' %>
to
<%= link_to 'Edit', edit_entry_path(#entry) %>
I'm building my second-ever basic Ruby on Rails application
Congrats! You need at least 3 more before it all starts to make sense
To add to the existing answers, you'll be best looking at the resources directive to clean the routes up:
#config/routes.rb
root 'entries#index'
devise_for :users
resources :entries
resources :pages, only: [:index], path_names: { index: "about" }
resources :users, only: [:index,:show]
--
A logged-in user should be able to edit only those entries that were originally created by that user.
This is known as authorization.
Authentication = is user logged in?
Authorization = can user do this?
Although people confuse Devise with being able to handle authorization, it only handles authentication. Whilst you have a simple implementation of this in your controller, you should check out either the CanCanCan or Pundit gems:
#Gemfile
gem "cancancan"
#app/models/ability.rb
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new # guest user (not logged in)
can :manage, Post, user_id: user.id
end
end
#app/controllers/entries_controller.rb
class EntriesController < ApplicationController
def edit
authorize! :edit, #entry
end
end
--
Finally, to answer your question directly, you're calling the update method (which doesn't exist) to access the edit view:
<% if current_user %>
<%= link_to 'Edit', #entry, :method => 'update' %>
<%= link_to 'Delete', #entry, :method => 'delete' %>
<% end %>
You should read up about http verbs - this is what the "method" option invokes with the link. As mentioned above, you don't need to set the method for edit as it uses GET. Update uses put/patch, which I can explain later.
A much better way to achieve what you want would be the following:
<%= link_to "Edit", edit_entry_path(#entry) if can? :edit, #entry %>
<%= link_to "Delete", #entry, method: :delete, if can? :destroy, #entry %>
The above uses the CanCanCan authorization method can?

Creating a button to make user an admin

I am doing Hartl's tutorial and I want to make other users admins. Can I create a button that links to a action that updates the user's attributes to make them an admin?
<%= button_to "Make Admin", {action: "make_admin" }, method: :put %>
Users controller
def make_admin
update_attribute(:admin, true)
redirect_to users_url
end
routes.rb
put 'admin' => 'users#make_admin'
Had trouble referencing the right user. Any suggestions or a sure-fire way?
Thanks
Route is missing an :id. Change it to
put 'admin/:id' => 'users#make_admin', :as => "make_admin"
Also, for button_to:
<%= button_to "Make Admin", {action: "make_admin", id: current_user.id }, method: :put %>
and UsersController:
def make_admin
user = User.find params[:id]
user.update( :admin => true )
redirect_to users_url
end

Rails error while working through JumpStartLabs Blogger 2 Tutorial(trying to implement tag deletion)

I've been fighting with this error for a while now and I'm sure that it is something simple that I am missing. I'm working through the Blogger 2 tutorial by jumpstartlabs(http://tutorials.jumpstartlab.com/projects/blogger.html#i3:-tagging).
I'm attempting to implement a way to delete existing tags through the UI. I'm stuck trying to resolve this error:
No route matches [POST] "/tags/3"
My routes.rb is:
Blogger::Application.routes.draw do
root to: 'articles#index'
resources :articles do
resources :comments
end
resources :tags
end
and here is my tags controller:
class TagsController < ApplicationController
def show
#tag = Tag.find(params[:id])
end
def index
#tags = Tag.all
end
def destroy
#tag = Tag.find(params[:id])
#tag.destroy
flash.notice = "Tag '#{#tag.name}' Deleted!"
redirect_to action: 'index'
end
end
Finally, here is the page that I'm displaying the deletion link on:
<h1>All Tags</h1>
<ul id="tags">
<% #tags.each do |tag| %>
<li>
<%= link_to tag.name, tag_path(tag), class: 'tag_title' %>
<%= link_to "Delete", tag_path(tag), method: :destroy, data: {confirm: "Really delete the tag?"} %>
</li>
<% end %>
<%= link_to "<< Back to Articles List", articles_path %>
</ul>
As #BillTurner mentioned, try changing method from :destroy to :delete. Make sure you save the change, reboot the server, and let me know if that works.
that answer didn't work out for me, but I found elsewhere that => fixed it
<%= link_to "delete", article_path(#article), :method => :delete, data: {confirm: "Really delete the article?"} %>
(that's in the view app\views\articles\show.html.erb)

Resources