app/controllers/application_controller.rb
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception.
For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception . For APIs you may want to use : null_session instead .
def access_only_with_roles(*roles)
    if current_user
      unless roles.include? current_user.role
        session[:target_url] = request.fullpath
        redirect_to new_session_path, flash: { warning: 'Access denied.  Insufficient rights.' }
      end
    end
  end
def access_only_with_roles ( * roles ) if current_user unless roles . include? current_user . role session [ :target_url ] = request . fullpath redirect_to new_session_path , flash : { warning : 'Access denied.  Insufficient rights.' } end end end
Prevent CSRF attacks by raising an exception.
Prevent CSRF attacks by raising an exception .
roles
<not_specific>