Rails%203%20In%20Action

282 CHAPTER 10 Tracking state
10.5.3 Hacking a form
Even if your state field is hidden from view, users are still able to submit a form
containing this parameter, and your application will accept it. Let’s now see this in
practice.
The first things you need to do are to create a user and give it read access to a
project, which you can do by starting rails console (or rails c) and running these
commands:
user = Factory(:user)
user.confirm!
user.permissions.create(:object => Project.first,
:action => "view")
Let’s quit the console by typing exit and then start up the application with rails
server. Now you can sign in with the user@ticketee.com email and password password.
Once you’re in, you should see the page shown in figure 10.16.
Let’s go into this project and pick any
ticket in the list or create your own. It
doesn’t matter, you just need a ticket. When
you’re on the ticket page, save this page by
choosing File and then Save or Save Page As,
and save this file in a memorable location.
You’re going to be editing this saved file and
adding a State select box of your own.
Open this saved file in a text editor, and Figure 10.16 What the user sees
look for the following lines:
Text
These lines display the Text label and the associated textarea for a new comment.
You’re able to add the state field underneath the text field by adding this code 5 to
the page:
State
New
Open
Closed
When you save this page, you’ll now be able to choose a state when you open it in a
browser. The action of the form tag on this page goes to http://localhost:3000/tickets
5 Assuming you know the IDs of the states.