Worker编辑页面信息错误、删除功能失效及权限跳转问题求助

• 编辑页面显示错误Worker信息：尝试编辑Worker A时，表单加载的是Worker B的详情；仅管理员账号能正常编辑自身信息，点击其他Worker的编辑按钮会跳转至登录页
• 删除功能失效：控制台显示触发的是GET请求而非DELETE请求

Worker Controller #

def show
 @worker = Worker.find(params[:id])
end

def edit
  @worker = Worker.find(params[:id])
  @worker.company_id = params[:company_id]
  @role = Role.all
end

def update
  @worker = Worker.find(params[:id])
  @company_id = Company.find(params[:worker][:company_id])
  @role_id = Role.all
  if @worker.update(worker_params)
  @worker_role = Role.find(params[:worker][:role_id]).worker_roles.update(worker: @worker)
  flash[:success] = "Profile updated"
  redirect_to @worker
 else
   render 'edit'
  end
end

#DELETE
def destroy
 @worker = Worker.find(params[:id])
 @worker.destroy
 flash[:success] = "Worker deleted"
 redirect_to worker_url
end

edit.html.erb #

<% provide(:title, "Edit worker") %>
<h1>Update your profile</h1>

<div class="row">
  <div class="col-md-6 col-md-offset-3">
  <%= form_with(model: @worker, local: true) do |f| %>
  <%= render 'shared/error_messages', object: f.object %>

  <%= f.label :name %>
  <%= f.text_field :name, class: 'form-control' %>

  <%= f.label :email %>
  <%= f.email_field :email, class: 'form-control' %>

  <%= f.label :phone_number %>
  <%= f.number_field :phone_number, class: 'form-control' %>

  <%= f.label :address %>
  <%= f.text_field :address, class: 'form-control' %>

  <%= f.label :password %>
  <%= f.password_field :password, class: 'form-control' %>

  <%= f.label :role_id %>
  <%= f.select(:role_id, Role.all.collect { |l| [ l.name, l.id] }, {class: "form-select"}) %>

  <%= f.hidden_field :company_id , value: 2%>

  <%= f.submit "Save changes", class: "btn btn-primary" %>
 <% end %>
</div>
</div>

show.html.erb #

<% provide(:title, @worker.name)%>

<h2>Worker Info</h2>

<%= render @worker %>
<div class="row">
 <aside class="col-md-4">
   <section class="stats">
    <%= render 'shared/stats' %>
   </section>
   <div>
    <button class="btn btn-secondary"><%= link_to "Back to workers", workers_path %></button>
    <button class="btn btn-secondary"><%= link_to "Edit", edit_worker_path(current_worker) %></button>
    <button class="btn btn-secondary"><%= link_to "Delete", @worker, :confirm => "Are you sure?" ,:method => :delete%></button>
  </div>
 </aside>
</div>

一、编辑页面信息错误&权限跳转问题 #

1. 修复编辑链接参数 #

show.html.erb中编辑按钮的edit_worker_path(current_worker)会固定跳转当前登录用户的编辑页，需改为对应Worker的路径：

<%= link_to "Edit", edit_worker_path(@worker), class: "btn btn-secondary" %>

2. 删除Edit方法冗余赋值 #

Controller的edit方法中@worker.company_id = params[:company_id]会覆盖数据库中查询到的原始值，直接删除该行即可。

3. 添加权限验证 #

在Worker Controller顶部添加权限拦截逻辑，控制普通用户仅能编辑自身信息，管理员可编辑所有用户：

before_action :correct_worker, only: [:edit, :update, :destroy]

private
def correct_worker
  @worker = Worker.find(params[:id])
  unless current_worker == @worker || current_worker.admin?
    flash[:danger] = "无操作权限"
    redirect_to root_url
  end
end

二、删除功能失效问题 #

1. 修复按钮嵌套问题 #

link_to生成的a标签嵌套在button中会导致浏览器默认触发GET请求，直接用link_to的class实现按钮样式：

<%= link_to "Delete", @worker, confirm: "Are you sure?", method: :delete, class: "btn btn-secondary" %>

或改用button_to生成表单提交DELETE请求：

<%= button_to "Delete", @worker, confirm: "Are you sure?", method: :delete, class: "btn btn-secondary" %>

2. 确保Rails UJS加载 #

检查application.js中是否包含UJS依赖：

• Rails 5及之前：//= require rails-ujs
• Rails 6+：import Rails from "@rails/ujs"; Rails.start()

3. 修复Destroy方法跳转路径 #

redirect_to worker_url需传入id参数，改为列表页路径：

redirect_to workers_path

内容的提问来源于stack exchange，提问作者cherry123