Q:

Rails user defined views

I'm trying to create user defined views in Rails.
I have a uview record for each view.  It contains an hstore field called ufields.  In ufields I'm storing the names of the columns to be used in the table view.
I can create the table's thead like this:
  <thead>
  <tr>
    <% uview.ufields.each do |key, val| %>
        <th><%= key %></th>
    <% end %>
  </tr>
  </thead>

But, how can I define the fields for the tbody.
This doesn't work:
  <tr>
    <% uview.ufields.each do |key, val| %>
        <% ufield = "vehicle." + key %>
        <td><%= ufield %></td>
    <% end %>
  </tr>

That just puts out rows like this vehicle.name.
Is there a way to have this happen? <td><%= vehicle.name %>
This doesn't work, but might give you an idea of what I'm trying to do:
             <td><%= <%= ufield %> %></td>

A:

Try:
<% uview.ufields.each do |key, val| %>
    <td><%= vehicle[key] %></td>
<% end %>

Actually you could be tempted to do:
vehicle.send key
vehicle.public_send key

But you'd expose to serious flaws since you trust user's inputs

An alternative would be to have in vehicle class:
WHITELISTED_USER_ATTRS = %w(name id) #add what you need but not stuff like destroy etc...

def user_input(key)
  if WHITELISTED_USER_ATTRS.include?(key.to_s)
    vehicle.send key
  else
    ""
  end
end

Then in the view:
<% uview.ufields.each do |key, val| %>
    <td><%= vehicle.user_input(key) %></td>
<% end %>

