How to restrict access to a path like user/%/flag?

Question

I have created a views to display flagged content. But the flag page is accessed by all users. I want users to access only their own flagged page.

Answer 1

You need to create custom Views access plugin for this. First, you need to create mymodule.info file with next code

name = Mymodule
description = Custom code
core = 7.x
package = custom
dependencies[] = views
files[] = mymodule_access_plugin.inc

Second, add mymodule_access_plugin.inc in the your module folder with next code

<?php

/**
 * Access plugin that provides property based access control.
 */
class mymodule_access_plugin extends views_plugin_access {

  function summary_title() {
    return t('Custom access plugin');
  } // summary_title()

  /**
   * Determine if the current user has access or not.
   */
  function access($account) {    
    return mymodule_access($account);
  }

  function get_access_callback() {
    return array('mymodule_access', array());
  }

}

Third, implement hook_views_plugins in your mymodule.module file

<?php

/**
 * Implements hook_views_plugins()
 */
function mymodule_views_plugins() {
  $plugins = array(
    'access' => array(
      'test' => array(
        'title' => t('Custom access check'),
        'help' => t('This is a custom access plugin'),
        'handler' => 'mymodule_access_plugin',
        'path' => drupal_get_path('module', 'mymodule'),
      ),
    ),
  );
  return $plugins;
}

function mymodule_access($account = NULL) {
  global $user;
  if (!empty($account->uid) && $account->uid == $user->uid) {
    return TRUE;
  }
  else {
    return FALSE;
  }
}

Fourth, clear caches and apply your custom access plugin in views

Answer 2

Use the Rules module, and a rule that is a variation of the rule I included (in export format) in my answer to the question about How to restrict access to a node via node/12 and allow access via a path like content/sometitle?

These are the changes to that rule to make it work for this case also:

• Change node to user and add /flag at the end.
• Add a Rules 'Condition' like "If the value used for % does not match the uid".
• Change the "Message" (in the Rules 'Action'- to something to indicate that the user can only use a value that matches their own uid.
• Modify the Rules 'Action' to fit your own requirements, e.g. to issue a redirect to their own 'flagged page'!

Haven't experimented/tried creating this rule (= variation of the rule in the answer I mentioned above). But pretty sure it'll work. Hopefully you'll be able to complete the rest of the puzzle in my answer on your own.