2

I am trying to restrict edit(node/%nid/edit) access only to users defined in one of the node fields. can I use hook menu alter for node/%nid/edit so i can write a custom access callback or use hook node access to achieve it. One thing to mention here is any user can comment on that node and when they save the comment, I am updating some fields on the node and saving it thru node_save. What will be the best way to achieve this access restriction.

2 Answers 2

2

As per me the best way to restrict the edit access would be by implementing hook_node_access, something like the following:

function MODULE_node_access($node, $op, $account) {
  if ($op == 'update' && $node->type == 'YOUR_TYPE' && $node->field_custom[LANGUAGE_NONE][0]['value'] == 'some value') {
    return NODE_ACCESS_ALLOW;
  }
  else {
    return NODE_ACCESS_DENY;
  }

}
1
  • You should probably note that using LANGUAGE_NONE will break horribly if field translation is used. You should use field_view_value
    – Pinoniq
    Sep 3, 2015 at 11:23
1

I'm not sure if it'll be considered as the best way, but a possible way to address your question is to use the Rules module, and a rule that is a variation of the rule I included (in export format) in my answer to the question about How to restrict access to a node via node/12 and allow access via a path like content/sometitle?

These are the changes to that rule to make it work for this case also:

  • Append /edit at the end anywhere there is already something like node/%.
  • Add a Rules 'Condition' to verify your "... access only to users defined in one of the node fields".
  • Change the "Message" (in the Rules 'Action') to something that fits your needs.
  • Modify the Rules 'Action' to fit your own requirements, e.g. to issue a redirect to some other page.

Haven't experimented/tried creating this rule (= variation of the rule in the answer I mentioned above). But pretty sure it'll work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.