1

I have a semi-new Drupal 7 site in which admins approve the accounts of managers, and managers approve accounts of their employees. That's all working great. I've been asked to make it so that managers can delete the employee accounts that are no longer needed.

Using our old CMS, when all of our SQL was hand written I could build a "where" statement like :

$cWhere = "WHERE e.department = 'HR' and e.manager = 12345"

These items are not user entered, but based on the logged in person. To show a list of employees I could run :

"SELECT * FROM users " . $cWhere

Then to delete I could run :

"DELETE FROM users " . $cWhere . " AND uid = " . $deleteUser

This would ensure that the person who is logged in and trying to delete a user had the permission to do it, because the additional conditions of manager and department were checked. Furthermore, if the conditions for the employee list are changed, the delete code is automatically updated to take the new conditions in to account with no additional work needed. For the record, the query is considerably more complex than that, but no reason to make the question harder than it needs to be.

Now I'm doing everything with db_select. So I build the query to show the list of users. I need an additional query to check that the logged in user has permission to delete the target user. Then I would call the user_delete() function. Is there any way to do this, or do I have to rebuild the query completely a second time?

Non-working code, but something like this :

if (isset($deleteUser))
{
   $chkUser = $query; //$query is an existing db_select that hasn't been ran yet
   $chkUser->condition('u.uid', $deleteUser, '=');
   $rowsUser = $chkUser->execute();
   if ($rowsUser->rowCount() == 1)
   {
       user_delete($deleteUser); //user has permission
   }
}

$result = $query->extend('PagerDefault')->limit(20)->execute();

//... loop results, output list ...

Note, I have tried the above with the user_delete() commented out... but $chkUser is obviously a pointer to $query, as the list printed ends up being just the user in question. So everything works the way I need, except I've mangled my user listing query doing it this way.

1

You can use the function db_and() an db_or() to compile condition sets that you can the add to an existing query like this:

$query = db_select('Exhibitors', 'e');
$db_and = db_and();
$db_and->condition('ProductCategory', array(1,2,3), 'IN');
$db_and->condition('status', 'active');
$query->condition($db_and);

Example taken form here: https://api.drupal.org/api/drupal/includes!database!database.inc/function/db_and/7

Other than that, there is the DatabaseCondition Class that might be interesting for you too.

  • That should actually be able to do exactly what I needed. Thanks! – DragonYen Feb 13 '14 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.