How to restrict editing some node properties (like title / URL) for some users (roles)?

Question

I would like to know how I can restrict editing some property of nodes (like title / Url) for some users (roles).

So if I give -moderator access- to some users, they don't start messing with urls and I have to make 301.

Answer 1

If you want finer control over any field then you can implement hook_field_access($op, $field, $entity_type, $entity, $account) and provide/deny access.

Determine whether the user has access to a given field.

This hook is invoked from field_access() to let modules block access to operations on fields. If no module returns FALSE, the operation is allowed.

Answer 2

In the Admin menu navigate to admin/people/permissions

Set the following tick boxes as you like...

Path>Administer URL Aliases

Path>Create and edit URL Aliases

You can do this with almost any aspect of your site...

Answer 3

You can also do that with a simple implementation of hook_form_BASE_FORM_ID_alter().

function YOURMODULE_form_node_form_alter(&$form, &$form_state, $form_id) {
  if ($form['#node']->type == 'YOUR_NODE_TYPE') {
    $form['title']['#type'] = 'value';
    $form['title']['#required'] = FALSE;
  }
}

Answer 4

You can Use Title module to restrict changes on Title field. You could also try the WikiTools module for Node Title restrictions.

Here is one of the WikiTools module feature

Move Protection: Disallow change of node titles for users without administer nodes permission.

As @iain maitland suggested you can give permissions to roles for URL Aliases.

Answer 5

There's a couple of modules that might suit your needs, like Automatic Nodetitles:

 "auto_nodetitle" is a small and efficient module that allows hiding of the    
content title field in the form. To prevent empty content title fields one can 
configure it to generate the title by a given pattern.

This depends on your permissions and set up of course...

Answer 6

Implementing such restrictions is pretty forward by using the Rules module for this. As a sample, consider this scenario:

• Don't allow updates to the title of a node of type "Article".
• But do allow users with a specific role (such as "administrators", but it can be any role) anyhow. So updates to the title should be allowed by such role (only).
• If an attempt to update a title of an article is discovered by a user who does not have the administrator role, then just ignore the attempted update to the title (but do save all other updates to the node).

To implement this scenario, just use this rule for it:

{ "rules_verify_updates_to_node_properties" : {
    "LABEL" : "Verify updates to node properties",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "node_presave--article" : { "bundle" : "article" } },
    "IF" : [
      { "NOT user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "3" : "3" } }
        }
      },
      { "NOT data_is" : { "data" : [ "node-unchanged:title" ], "value" : "[node:title]" } }
    ],
    "DO" : [
      { "drupal_message" : {
          "message" : "Tampering rejected ... An attempt to update the title of node with ID \u0022[node:nid]\u0022 was discovered (from \u0022[node-unchanged:title]\u0022 to \u0022[node:title]\u0022), by user \u0022[site:current-user]\u0022, who does not have the authorization to do so. The attempted update of the title has not been saved (all other updates were applied).",
          "type" : "error"
        }
      },
      { "data_set" : { "data" : [ "node:title" ], "value" : "[node-unchanged:title]" } }
    ]
  }
}

If somebody who is not an administrator (the role that corresponds to role id = "3") tries the above scenario (with the above rule enabled), that user will get a Drupal error message similar like this one:

Tampering rejected ... An attempt to update the title of node with ID "X" was discovered (from "Original title of this article" to "Attempted update of title of this article"), by user "Some.Userid", who does not have the authorization to do so. The attempted update of the title has not been saved (all other updates were applied).

Obviously, X and Some.Userid will be replaced by the actual node ID and username.

Works like a charm ... Similar approach for any other node property ... And straight forward to apply for any other content type (instead of "Article"), or just all content types.