Ruby on Rails评论表单添加密码验证功能技术求助

Hey there! Let's fix this password validation issue for your review form step by step. I see you've been stuck on this for days, so let's break down the problems in your code and get it working properly.

Step 1: Fix the Product Model's reviewcode Method #

First, your Product model's reviewcode method isn't returning the password correctly. Right now, it creates a local variable but never returns it, so calling @product.reviewcode will always return nil—that's why your password check was failing every time.

Update the method to directly return your desired password:

class Product < ApplicationRecord
  # ... keep all your existing validations and associations ...
  def reviewcode
    "1234" # Replace this with your actual desired password, or use a database column if you want dynamic codes
  end
end

Step 2: Rewrite the Reviews Controller Logic #

Your controller's create method has messed-up order and missing setup for @product. Let's restructure it properly:

class ReviewsController < ApplicationController
  before_action :authenticate_user!
  before_action :set_product, only: [:new, :create] # Load the product before new/create actions

  def new
    @review = @product.reviews.new # Initialize a review for the form
  end

  def create
    @review = current_user.reviews.new(review_params)
    @review.product = @product # Associate the review with the loaded product

    # Check if the entered password matches the product's reviewcode
    if @review.password == @product.reviewcode
      if @review.save
        redirect_to @product, notice: "Commentaire ajouté avec succès!"
      else
        # If review validation fails (e.g. empty comment), go back to the form
        render :new
      end
    else
      # Add a custom error message for wrong password
      @review.errors.add(:password, "Wrong password...Try again..")
      render :new
    end
  end

  private

  def review_params
    # Remove product_id and user_id—we set these via current_user and @product for security
    params.require(:review).permit(:comment, :star, :password)
  end

  def set_product
    # Correctly find the product using the product_id from the URL
    @product = Product.find(params[:product_id])
  end
end

Key fixes here:

• We load the product with a before_action so @product is always available in new and create
• We validate the password before trying to save the review
• We add a clear error message when the password is wrong
• We avoid passing product_id and user_id through the form (safer, since we set them server-side)

Step 3: Update the Review Model (Optional But Recommended) #

Since you don't need to store the password in the database (it's just for validation), add a callback to clear it before saving:

class Review < ApplicationRecord
  belongs_to :product
  belongs_to :user
  validates :comment, presence: true
  validates :star, presence: true
  validates :password, presence: { message: "Veuillez saisir le mot de passe" }

  # Clear the password before saving to the database
  before_save :clear_password

  private

  def clear_password
    self.password = nil
  end
end

Step 4: Fix the Review Form View #

Update your view to use the initialized @review variable and display error messages so users know what went wrong:

<% if @product.reviews.present? %>
  Il y a deja un commentaire.
<% else %>
  <%= form_for([@product, @review]) do |f| %>
    <!-- Show all validation errors -->
    <% if @review.errors.any? %>
      <div class="alert alert-danger">
        <ul>
          <% @review.errors.full_messages.each do |msg| %>
            <li><%= msg %></li>
          <% end %>
        </ul>
      </div>
    <% end %>

    <div id="user_stars"></div>
    <%= f.text_area :comment, rows: 3, class: "form-control" %>
    <br>
    <%= f.label "Mot de passe communiqué par le vendeur:" %>
    <%= f.password_field :password, class: "form-control" %>
    <!-- Show password-specific error -->
    <% if @review.errors[:password].any? %>
      <small class="text-danger"><%= @review.errors[:password].first %></small>
    <% end %>

    <div class="actions mt-3">
      <%= f.submit "Evaluez", class: "btn btn-primary" %>
    </div>
  <% end %>
<% end %>

Step 5: Double-Check Your Routes #

Make sure your routes.rb has nested review routes to tie reviews to products:

resources :products do
  resources :reviews, only: [:new, :create]
end

That's it! Now when a user enters the wrong password, they'll see your custom error message, and the review will only be created if the password matches the product's reviewcode.

内容的提问来源于stack exchange，提问作者SamyCha