Alternative to using hidden fields in Rails. Keeping things secure

Question

I am setting up a system of posts, where a user's posts would always have to be moderated by a superuser unless they are a "verified" user (User.verified = true) I was going to setup a boolean column in the User model, :verified and if that is true, then allow them to post and circumvent moderation. So, when the user would go to post... I know i could easily set up a hidden field for a post. For example, in my post form, I could add ``` <%= f.hidden_field :approved, :value => 1 if current_user.verified == 1 %> ``` However, i know this is not secure, and anyone could easily use firebug to modify this. What is the best practice to move this logic into the model/controller, or is there a good resource link that covers this sort of thing, overriding or modifying the "default" create/update actions? thanks Per the answer below, here is what i have now in my Post model: ``` #If user is verified, set approved column to true before_save :check_for_verified def check_for_verified approved = us…

Accepted Answer

Your feeling that this does not belong in the view is correct.

There are lots of ways you could go about this. One way would be to set up a before_create callback on the model that sets approved if the user is verified

```
class Post

before_create :approve_if_user_verified

def approve_if_user_verified
  approved = user.verified?
end
```

Alternative to using hidden fields in Rails. Keeping things secure

Solution

Problem