2

I just built a view to display user information. I can see this view just fine as a root admin but when I log in as a different user, the view is restricted.

What governs view access?

Is it a compost of all the permissions involved in the data that is being viewed? If I want to block a user from looking at a view, do I restrict some or all of the content? Is there a way to set up a permission directly one a view?

1 Answer 1

3

There are two things which govern access to views and their results.

  1. The access settings for the view. These are found on the view page and can be based on permissions or roles. This is a base rule for who can see this view.

  2. The access settings for the content being displayed by the view. This is definitely where things get a bit funky. Essentially, views doesn't collaborate with Drupal permissions or hook_node_access(). It will show content users might not have the permission to see or content that has been safeguarded by hook_node_access(). That makes these two methods pretty useless for protecting content.

What actually happens is that views queries the {node}, {user} or other entity table and retrieves nid's, uid's or other entity id's. At no stage does it check permissions or hook_node_access(). However, when checking nodes it does join with the {node_access} table to determine if that system has any rules about the content. Note that hook_node_access() doesn't really have anything to do with the node_access system.

By default you probably aren't using the node_access() system, but if you are using a module like content_access then you are using this system and it may be restricting views results.

If you have devel module installed, you can use the block with the title Devel node access and place it on a node page. Now when you visit that page, it will show the roles and their access level. Note that you need to access that nodes page with a user with that role before it will show in the block. This is the access record which will determine if the node can show in a views result.

1
  • It sounds like the most reliable way to restrict visits to a view is to set up a restriction on the view itself. Otherwise the users may see things they shouldn't. I found the permissions settings in the 'Page Settings' sections in the middle column of the view.
    – Hoytman
    Apr 15, 2014 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.