In rails 4.2, how to display a form for preview but ensure it cannot be submitted -

i'd have a form view can, depending on circumstances, have submit functionality disabled in bullet-proof way clever user not edit html source (via browser extension) re-add submit button.

it seems 1 way might somehow inject invalid authenticity token replaces (valid) rails-generated one, if user somehow re-adds submit button (by editing html via browser extension) still invalid submission.

my thought have logic in view:

- if @form_disabled   # set controller   - somehow_invalidate_the_authenticity_token? 

how might 1 'break' rails form submission?

the purpose of doing this, instead of rendering preview in :show action, have exact same view displaying both live-form , dead-form.

if you, use pundit.

it's pretty simple, , has few lines of code if need know how works.

i'd start write code here, realize example @ readme fit needs.

at application controller add this

at folder app/policies put class postpolicy, of course, must replace "post" name of controller in singular (even if have not model name). update? (and create?) actions should return true/false indicate if user allowed or not.

a few lines down on readme, find postscontroller#update action, call authorize record before update. think want same create (then need create? method @ policy class).

pundit needs current_user controller method, if don't have it. follow user customization instructions.

of course, new , edit actions don't call authorize because allowed everybody. post & put/patch actions forbidden.

yes, it's more surgery of 1 line of code. it's simple , right way of give access users.