I have a "Project" custom content type, and a View displaying existing Projects. The site has two types of users, with most users permissions set to only view Projects they created. The other user type is an 'admin' type who can view anything.
The site has half dozen custom modules I wrote. Among that custom logic are three new permission types: "View CEX Projects", "Access CEX Services" and "Admin CEX Services". Plus the associated hook_access() implementation handling the access situations for the Projects.
The issue that I'm having is the Access settings for the View. I can't seem to find the right combination of settings so a regular user only sees Projects they created. Maybe it's right in front of me and I'm missing it...
The Projects View has three displays. There is a "Page" that displays all Projects with an 'active' field set to true; There is a "Page" displaying all "inactive" Projects. And there is a Block-View of the first Active Projects View, displaying fewer Projects before paging than the "full page" version.
Other than the "active" field's use in the Filters, the two Page versions are identical. Other than the number of Projects displayed, the Page and Block versions are identical.
In Basic Settings->Access they are configured for "Multiple roles", with the roles selected being the roles with permission to view/access/admin the webapp's projects/services.
There is a Relationship (and a related hook_views_data() implementation) connecting the author of a Project to the Views data of that Project. This is used in the Filters area for a Node Access filter. The Node Access Filter is supposed to use each Project's UserID for determining access to that Project.
Problem is the View (all three versions) display all the Projects. What's displayed is summary data, and links to the Projects. Clicking a link to a Project one does not own goes to an Access Denied page...
It's as if the Node Access Filter using the UserID relationship is not working at all... There's not much of an interface to the Access Control filter... it just asks if it should use the UserID relationship or not... selecting either one makes no difference.... maybe the Access Control Filter does not control display of the output??
Added: Here's the query generated by Views (interesting that I don't see any access logic):
SELECT DISTINCT(node.nid) AS nid,
node.title AS node_title,
node_node__users.name AS node_node__users_name,
node_node__users.uid AS node_node__users_uid,
node_revisions.teaser AS node_revisions_teaser,
node_revisions.format AS node_revisions_format,
node.vid AS node_vid,
node.type AS node_type,
DATE_FORMAT((FROM_UNIXTIME(node.changed) + INTERVAL -25200 SECOND), '%Y%m%d%H%i') AS node_changed_minute
FROM node node
LEFT JOIN node node_node ON node.uid = node_node.uid
LEFT JOIN cex_project cex_project ON node.nid = cex_project.nid
INNER JOIN users node_node__users ON node_node.uid = node_node__users.uid
LEFT JOIN node_revisions node_revisions ON node.vid = node_revisions.vid
WHERE (node.status <> 0) AND (node.type in ('cex_proj')) AND (cex_project.active <> 0)
GROUP BY nid
ORDER BY node_changed_minute DESC
Added again: I just noticed this series of Views generated PHP error messages in my dlog:
Warning: Parameter 3 to views_ui_build_form_state() expected to be a reference, value given in views_ui_ajax_form() (line 1606 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).
Warning: call_user_func_array() expects parameter 1 to be a valid callback, no array or string given in drupal_retrieve_form() (line 378 of C:\wamp\www\includes\form.inc).
Warning: Invalid argument supplied for foreach() in views_ui_build_form_url() (line 1542 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).
Warning: Attempt to assign property of non-object in views_ui_ajax_form() (line 1613 of C:\wamp\www\sites\all\modules\views\includes\admin.inc).
turning off the "Use ajax" setting seems to have stopped those error messages, but the Access issue still exists: anyone gets all Project nodes in their View even if they do not have access to them. Clicking a Project node a user does not own triggers the Access Denied page.
