1

I have set some users with 'update' access to some books and all other users have only 'view' access. I have used hook_node_view_alter() to remove the 'Add child page' link for users with 'view' only access. The problem this only hides the link from the corresponding node pages, those users are still able to add a child page by manually going to the url: /node/add/child-content-type?parent="mlid" where mlid is the "menu link id" for the parent node. The users might not know particular parent node link id's, however this is a security hole I want to get rid of.

How can I get this passed argument as "?parent=" in a php variable and what hook function should I use to run the condition checks for user access? I am using drupal 7.

  • Sounds like a job for "Organic Groups". Am I right in saying you want different groups of users to have different permissions over different books (groups of nodes)? – Queenvictoria Jun 18 '14 at 16:21
  • Actually any authenticated user can create a book and then s/he can allow some users to edit the book/add child pages and some other users to only view the book content. The user access' are handled using entity reference fields and a custom user access module. – user30612 Jun 18 '14 at 16:52
  • Yeah I've done exactly the same thing with Book module and OG module. Anyone creates a Book (which is a Group parent) and adds other users to their Group. Then all children need to get added to that Group. I think there was a bit of custom work in there but its the same as your use case. – Queenvictoria Jun 19 '14 at 0:06
  • Then shouldn't you have two groups for every book with two access options: 'update' and 'view'? Also, if the author wants the book to be viewable by anyone, is it possible to do it with OG? – user30612 Jun 19 '14 at 2:20
0

After some more internet research and experimentation on my side, I solved the problem.

  1. The passed argument as "?parent=" was acquired using $_GET['parent'].

  2. I programmatically checked if the user has access to create a child with the provided parent using the hook_FORM_ID_alter().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.