Restrict forum access based on user (user list)

Question

I need to restrict access to forums so that only selected users can access an individual forum. (The users should apply for a forum and a moderator should decide if the user should be allowed to participate in that forum or not.)

If users visit the forum listing page for the first time, they should only see all forums listed but they should not be able to see the topics.

I have used Flag module to implement a subscription system.

I have set a flag 'subscribe_forum' that allows users to flag a forum, and another flag 'approve_forum_subscription' that allows an administrator to flag a flagging, which means the subscription of the user is accepted.

What I want to do is to grant that user access only to those forums which he has subscribed to and has been approved by an administrator.

The solution you would suggest doesn't have to use this flag system. I am open to any other suggestions.

I have installed Forum Access module, however it allows me to restrict access based on roles, but I need to have a list of users for each individual forum. The only thing that is useful for my case on this module is the ability to set a moderator for individual forums.

Edit: I am also using Advanced Forum module to extend the functionality of the core Forum.

UPDATE:

I have mostly achieved my goal using Panel pages which are already provided by Advanced Forum, adding some custom selection rules.

I have added a PHP Code rule which returns TRUE if the user has flagged the forum, and a moderator accepted it (i.e. flagged the flagging of the user), and FALSE otherwise. I have also added a fallback variant which shows only an 'access denied' message in a panel pane.

I have done the same thing to the topic listing panel, as well.

Then, I have enabled the panel page that overrides node/node% and added 2 selection rules, one for checking if the content type is forum and the other one is the custom PHP.

So, I have almost what I wanted to have, but I am not yet completely sure if this method I follow is a good one. To be honest, I don't find it elegant enough.

I am still open to other suggestions. It can also be a completely different approach.

Thanks in advance.

Answer 1

If you use views or panels to display the forum, you can use their access controls which are quite flexible. Doesn't look like AF has built views for everything, so I think the easiest way would be to use Panels.

Create a page and under the page settings you have access rules that can be quite elaborate within the UI. You can use a naked layout and then just had the forum entities as content to display and render the full node.

Second Look: Take a look at the Drupal Module Flexiaccess. It looks like exactly what is needed and has a nice UI to manage the users that have access to the individual forum with out writing/maintaining custom stuff:

The Flexi Access module will provide a simple and flexible interface to the ACL (Access Control List) module. It will let you set up and mange ACLs naming individual users that are allowed access to a particular node.

The module let you manage access to individual nodes. The administrator may grant individual users the right to: View (read), update (edit/write), and delete the node.

The main idea behind Flexi Access is to allow flexible per user access control for nodes without the complexity (or features) of Organic Lists, and without having to create a lot of (overlapping) roles.

I see you using Flag to set up the "subscription request" then a moderator looks at the flagged users with the Flag and if approves add em to the ACL with flexiaccess?

Answer 2

Maybe this is more reliable and worth trying:

• Create a user list in views with the subscribed users for every forum. In this view you should use the nid of the forum type as a contextual filter.

• Install and enable Rules Bonus Pack and Conditional Rules modules.

• Create a rule that will trigger on the event: "When a page variant is loaded" where the page variant = the forum page

• In that rule set an action "Load a user list with views" to load the above view

• Add a loop through that list

• Inside this loop add a conditional and then an Add if condition: uid of current user is not in that list (Data/List contains item/Negate)

• Finally continue (inside the same loop) by adding an action to redirect the user to some other page and if you want, add another action for the system to send a message like: "Your subscription has not yet been approved by the admin" or something.

I understand the answer is a bit brief. In case you need more details or some help with the rule let me know.

Answer 3

Since you want the most granular form of permission ( per-user), without too much of investigation, I would check:

https://drupal.org/project/user_permissions

Second way (non-entirely Drupal, but working) Or writing a custom module that does this functionality.(Gets list of users and a simple field 1 or 0, then in hook node preprocess (php) , you can add some simple logic, to show specific thing only if the value is 1. Also, that will involve some CRUD operations.

There might be other answers though.

Regards