8

I'm using the Views module to create a view that only specific users should be able to access. I know that Views includes access control by role or permissions, but I need something more fine-grained: Basically, I want to be able to say only user "x" and user "y" can access a particular view (or else someone with a site administrator role). So this would function very similar to how ACL module acts for individual nodes.

Is the best approach to create a custom views access plugin? I don't have much experience with this.

Also, I'm wondering about using an argument with some validation to accomplish this (so that I don't have to create dozens of separate views). For instance, since this view will be a tab on a specific node path, I'm wondering about setting up a user reference field on that node that specifies who could see the view. I'd just need a way for the view to only validate if the current user equals a user specified in the user reference field.

Any ideas? Or am I making this more complicated than it needs to be?

Thanks, Ben

Improve this question
3
  • You might have to write a views access plugin but if you could update your question with a little bit more detail then perhaps you could achieve it another way. What does the view do/display? Which users are allowed to view it? Do the users have different roles? Do the users have a specific field or something associated with them that allows them to access it?
    – Jamie Hollern
    Commented May 23, 2011 at 22:25
  • Jamie, Thanks for the reply. Actually, I'm also using Drupal Commerce to create a unique kind of online store. As a tab on each product node (in addition to View and Edit tabs), I want to create an additional tab called "Orders" that would be a view that shows all orders that have included that particular product. The supplier of the particular product is the user who I want to be able to see the "Orders" view for that product.
    – BenK
    Commented May 24, 2011 at 4:15
  • This way, the supplier can monitor sales of their product on an ongoing basis. But I don't want to grant access to everyone with a "supplier" role because then any supplier would be able to view the sales other suppliers' products. Make sense? ;-) --Ben
    – BenK
    Commented May 24, 2011 at 4:16

6 Answers 6

Reset to default
5

Instead of limiting permissions on the View, you could limit permissions on the menu item that leads to that view (be it a tab on a node or a menu callback). You could create your view with just a "Defaults" display and no Page display (so users can't just figure out the path to it). Then in your page callback for the menu item just call views_embed_view to display the view. It seems like handling permissions on a menu item might be easier than writing a new plug-in for Views (though a plug-in could be helpful for others).

Improve this answer
4
  • Thanks for the suggestion! I ended up following this general approach (which was also suggested by Berdir), but created a user reference field on each node called field_usercanaccess. I was able to use hook_menu() and define an access callback that made sure the current user matched a user referenced in the field. Otherwise, the tab (and view) wouldn't be displayed. This is working great! :-)
    – BenK
    Commented Jun 7, 2011 at 22:22
  • @BenK awesome! I'm glad you got something working. As part of helping make Drupal Answers a great resource, you should also vote on answers (or questions) you found useful. So you should probably vote for @Berdir's answer (and mine, but this isn't me trying to get votes, it's trying to make Drupal Answers a better site)
    – Chaulky
    Commented Jun 7, 2011 at 22:26
  • Thanks. :-) I'm new to Stack Exchange and I've only got 13 points. When I try to vote, it says I need 15 points to vote. So if someone has two points to spare (or I can earn them some other way) I definitely would vote on answers and questions. --Ben
    – BenK
    Commented Jun 7, 2011 at 22:57
  • @BenK oh right, I forgot about the 15 point limit. You can always try answering a questions... one upvote on your answer gets 10 rep.
    – Chaulky
    Commented Jun 8, 2011 at 2:45
6

Try the Views Access Callback module.

Provides callback-based access control for Views.

Available callback functions are defined by modules using hook_views_access_callbacks() function (in the same way as in hook_perm()), then could be set in the view's "Access restrictions" configuration.

Improve this answer
1
2

I must be missing something, but it sounds like you would create a new role and add these Users. Then use the Views' Access: Role feature.

If you do need to tie the Access rights to something in content, I would use a custom Views access, which I found a pain setting up the first time, but appreciate the flexibility once working. If the View is generating the Menu Item, it will not appear if the View does not pass the access function.

If you are only hiding a menu item, it would seem to me that the view would still run and a User could tweak a URI to view the data.

Jerry

Improve this answer
1

How about using the Custom Permissions module to create some new permissions specifically for your purpose, and then using the User Permissions module to assign those new permissions to individual users?

The custom permissions module is very lightweight. I'm not so sure about the User permissions module though, since it essentially creates a new role for each user behind the scenes (these roles are not visible on the main permissions page). If you have a lot of users, this may beef up the size of your roles and user_roles tables a little.

Improve this answer
2
  • That's an interesting suggestion to use Custom Permissions. I hadn't seen that module since it became broader than just Site Config Permissions. The only complication here is that I'm doing all of this in Drupal 7 (and there isn't an official branch yet). But if I could get that working it may be possible to specify the permission in the access control of the view directly (without needing User Permissions module). Thanks for the suggestion! :-)
    – BenK
    Commented May 24, 2011 at 21:10
  • I'll try that out and report back.
    – BenK
    Commented May 24, 2011 at 21:10
0

Right, that makes more sense. I think you could (possibly, not 100% sure) use a View and an argument. Set the argument to be a user id taken from the currently logged in user and make the default argument display nothing. That should be able to do it, although I don't know how secure it would be to be fair. If you give it a try, post back and let me know your progress.

Improve this answer
1
  • Yeah, I'll give things a try and report back. I'm also trying a views access plugin with an argument, so we'll see how it goes. Thanks.
    – BenK
    Commented May 24, 2011 at 21:11
0

If you're wanting to combine different access plugins in Views, you may want to have a look at the Views access many module.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.