0

I have product information on my site. Only some users can view pricing for certain suppliers. So each product has a supplier field, which is a node entity reference to an instance of a "supplier" content type.

When User A logs in, who only has access to Products Offered by Supplier B, he must only see the "cost price" of items that he is linked to. This link is currently accomplished using a Profile Field, which is private and set by administrators.

What is the best way to now restricting users based on this relationship. The end result would be that certain users see the full node with the cost price, while others will see everything except the cost price.

How can I get this right?

Improve this question

2 Answers 2

Reset to default
1

Install Field Permission module. In this module you can set permission on every filed of content types for different roles.

You can also modify hook_field_display_alter to check for the user and the field id and see if the user is allowed or not. you should copy this in to your template file.

Improve this answer
9
  • yes, but not per user, which is my problem. i will only have one role, and that is authenticated user.
    – rockstardev
    Commented Mar 23, 2015 at 19:24
  • create new role, assign that role to your specific users. What is your problem with creating role?
    – M a m a D
    Commented Mar 23, 2015 at 19:26
  • I updated the answer
    – M a m a D
    Commented Mar 23, 2015 at 19:33
  • If I have 5000 suppliers, that would mean 5000 roles, which is not what roles was designed for.
    – rockstardev
    Commented Mar 23, 2015 at 19:33
  • that is not 5000 roles, there is only 1 role, called it BANNED_USER and assign this role to any one you want
    – M a m a D
    Commented Mar 23, 2015 at 19:34
0

I needed to override hook_field_access. This is the only way I could easily create custom code that checks the current entity and compares it to a profile field of a user. And seeing as the entire entity is passed along, there is no need to do further node_load queries. I.e. It's pretty fast!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.