moviegoer_owns_review.rb

class ReviewsController < ApplicationController
  before_filter :moviegoer_owns_review, :only => [:edit, :update]
  def moviegoer_owns_review
    unless (review = Review.find_by_id(params[:id])) &&
        review.moviegoer == @current_user
      flash[:warning] = 'You can only edit your own reviews.'
      redirect_to movie_path(review.movie)
    end
  end
end