4

I have a "Project" custom content type, and a View displaying existing Projects. The site has two types of users, with most users permissions set to only view Projects they created. The other user type is an 'admin' type who can view anything.

The site has half dozen custom modules I wrote. Among that custom logic are three new permission types: "View CEX Projects", "Access CEX Services" and "Admin CEX Services". Plus the associated hook_access() implementation handling the access situations for the Projects.

The issue that I'm having is the Access settings for the View. I can't seem to find the right combination of settings so a regular user only sees Projects they created. Maybe it's right in front of me and I'm missing it...

The Projects View has three displays. There is a "Page" that displays all Projects with an 'active' field set to true; There is a "Page" displaying all "inactive" Projects. And there is a Block-View of the first Active Projects View, displaying fewer Projects before paging than the "full page" version.

Other than the "active" field's use in the Filters, the two Page versions are identical. Other than the number of Projects displayed, the Page and Block versions are identical.

In Basic Settings->Access they are configured for "Multiple roles", with the roles selected being the roles with permission to view/access/admin the webapp's projects/services.

There is a Relationship (and a related hook_views_data() implementation) connecting the author of a Project to the Views data of that Project. This is used in the Filters area for a Node Access filter. The Node Access Filter is supposed to use each Project's UserID for determining access to that Project.

Problem is the View (all three versions) display all the Projects. What's displayed is summary data, and links to the Projects. Clicking a link to a Project one does not own goes to an Access Denied page...

It's as if the Node Access Filter using the UserID relationship is not working at all... There's not much of an interface to the Access Control filter... it just asks if it should use the UserID relationship or not... selecting either one makes no difference.... maybe the Access Control Filter does not control display of the output??

Added: Here's the query generated by Views (interesting that I don't see any access logic):

SELECT DISTINCT(node.nid) AS nid,
   node.title AS node_title,
   node_node__users.name AS node_node__users_name,
   node_node__users.uid AS node_node__users_uid,
   node_revisions.teaser AS node_revisions_teaser,
   node_revisions.format AS node_revisions_format,
   node.vid AS node_vid,
   node.type AS node_type,
   DATE_FORMAT((FROM_UNIXTIME(node.changed) + INTERVAL -25200 SECOND), '%Y%m%d%H%i') AS node_changed_minute
 FROM node node 
 LEFT JOIN node node_node ON node.uid = node_node.uid
 LEFT JOIN cex_project cex_project ON node.nid = cex_project.nid
 INNER JOIN users node_node__users ON node_node.uid = node_node__users.uid
 LEFT JOIN node_revisions node_revisions ON node.vid = node_revisions.vid
 WHERE (node.status <> 0) AND (node.type in ('cex_proj')) AND (cex_project.active <> 0)
 GROUP BY nid
  ORDER BY node_changed_minute DESC

Added again: I just noticed this series of Views generated PHP error messages in my dlog:

Warning: Parameter 3 to views_ui_build_form_state() expected to be a reference, value given in views_ui_ajax_form() (line 1606 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).

Warning: call_user_func_array() expects parameter 1 to be a valid callback, no array or string given in drupal_retrieve_form() (line 378 of C:\wamp\www\includes\form.inc).

Warning: Invalid argument supplied for foreach() in views_ui_build_form_url() (line 1542 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).

Warning: Attempt to assign property of non-object in views_ui_ajax_form() (line 1613 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).

turning off the "Use ajax" setting seems to have stopped those error messages, but the Access issue still exists: anyone gets all Project nodes in their View even if they do not have access to them. Clicking a Project node a user does not own triggers the Access Denied page.

1

What I would do in this situation is create a view with two page display that have the same menu path. Set up the master permission of the 1st view to what ever the admin role is. Set up the master permissions of the 2nd view to be what ever permissions that is. Also modified the 2nd view (the one with the least protective permission) to filter based on nodes created by the current user.

Views it self will know that one view should be display to one user over the other. So your users with the admin permission will see the view with out the filter then other users will see the 2nd view which is filter by project they've created.

I'm not sure what your access function are doing, but this is one solution. Also I'm not sure how you're using the panel, so can't really comment on it.

0

Have you considered passing in the user as an argument to the view? If you use a views content pane, the argument can come from a panel context. Or maybe I misread your question?

  • Well, I already have the node author via the relationship, and the node author is the only person that has access (except admins)... The relationship's UserID is explicitly used in an Access Control Filter. Shouldn't that be enough? (I just added the query being generated by Views to my original question post.) – Blake Senftner Apr 6 '11 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.