0

I am trying to hide only a few fields for non-authenticated users, so I would like to bypass access check and check the permission in theme's template files and hide these fields accordingly. I am using Nodeaccess to control each node's permissions.

How could I bypass the permission check before theme_preprocess_node is called? I think after that I could use nodeaccess_node_access to check the permission manually.

update

I found it easy to bypass the permission check by implement the hook_node_access and return NODE_ACCESS_ALLOW for all, but I cannot use Nodeaccess to check permission later, module_invoke('nodeaccess', 'node_access', $node, $op, $account) returned nothing (NODE_ACCESS_IGNORE).

1

Take a look at the Field Permissions Module:

The Field Permissions module allows site administrators to set field-level permissions to edit, view and create fields on any entity.

Features

Enable field permissions on any entity, not just nodes. Role-based field permissions allowing different viewing patterned based on what access the user has. Author-level permissions allow viewing and editing of fields based on who the entity owner is. Permissions for each field are not enabled by default. Instead, administrators can enable these permissions explicitly for the fields where this feature is needed.

EDIT

Based on comments, either create a module using this or add this to a template.php file and adjust as necessary:

function THEME_OR_MODULE_NAME_node_view_alter(&$build)
{
    global $user;
    if($user->uid == 0)
    {
        if($build['#node']->nid == 1) // add node id's you want hidden here
        {
            if(isset($build['field_image']))
            {
                unset($build['field_image']);
            }
        }
    }
}

This example will hide the field_image field on the node id = 1 only for anonymous users. Use the machine names for the fields found on the manage fields tab of the content type.

If you prefer a UI ready option, you can look at the Content Access Module

This module allows you to manage permissions for content types by role and author. It allows you to specifiy custom view, edit and delete permissions for each content type. Optionally you can enable per content access settings, so you can customize the access for each content node.

  • Thank you, but I need node-level permission control, but field permissions only provide node-type-level field permission control, so I chose Nodeaccess. – leetom Jul 3 '15 at 15:27
  • @leetom - that doesn't make sense, Node Access restricts access to nodes, while your question says you are trying to restrict access to individual fields, which is exactly what Field Permissions does – Geoff Jul 3 '15 at 17:03
  • Sorry for the unclear description. I need to hide fields for SPECIFIED nodes instead of just return 403 page, but field permissions can only grant field permission for fields of ALL nodes of a type. – leetom Jul 3 '15 at 23:50
0

Here is what I am doing now:

use _nodeaccess_get_grants($node); to get the grants array, then compare this with user's roles. If there is grant, then label the node by adding a new attribute. Then return NODE_ACCESS_ALLOW and check the new attribute in theme files.

This solved my question, although not so graceful.

function userview_node_access($node, $op, $account){
    if($op == 'view'){
         $node_grants = _nodeaccess_get_grants($node);

        $have = _check_access($node_grants['rid'], $account->roles); // check if any role have access.

        $node->haveAccess = $have;
        return NODE_ACCESS_ALLOW;
    }

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.