security - cakePHP and authorization for CRUD operations -

i have cakephp 1.3 application , have run 'data leak' security hole. looking best solution using cake , not work. application grade tracking system lets teachers enter grades , students can retrieve grades. working expected when started audit security found basic crud operations have leaks. meaning student x can see student y's grades. students should see own grades. limit questions read operation.

using cake, have grade_controller.php file view function:

function view($id = null) {    // extra, not related code removed    $this->set('grade', $this->grade->read(null, $id)); } 

and

http://localhost/grade/view/5 

shows grade student $id=5. that's great. if student #5 manipulates url , changes 6, person #6's grades shown. classic data leak security hole.

i had 2 thoughts on best way resolve this. 1) can add checks every crud operations called in controller. or 2) add code model (for example using beforefind()) check if person x has access data element.

option #1 seems time consuming , error prone. option #2 seem best way go. but, required calling find() before operations. read() example above never executes beforefind() , there no beforeread() callback.

suggestions?

instead of having generic read() in controller, should move finds, queries..etc respective model.

then, go through each model , add type of security checks need on finds need restricted. 1) more dry coding, , 2) you'll better able manage security risks since know queries held.

for example, create getgrade($id) method in grade model , check student_id field (or whatever) against auth user id cakesession::read("auth.user.id");

you build generic method(s) similar is_owner() re-use same logic throughout multiple methods.