0

I made a custom view mode with display suite for the user entity. It is called "user_teaser" and shows some fields that may be visible for Anonomous user. Unfortunately currently anonymous users cannot see it because of the general "View user profiles" permission which they have no access to.

Which hook should I use to bypass this permission and allow anonymous to see my custom view mode?

I tried hook_entity_view_alter() as below, but this is called already too late I think as it is not even called when the access to the user profile is blocked.

function MODULE_entity_view_alter(&$build, $type) {
  if ($build['#view_mode'] == 'user_teaser') {
    $build['#access'] = TRUE;
    $build['user_image']['#access'] = TRUE;
  }
}

So I would need a hook_entity_access_alter or hook_user_access_alter or a hook_entity_access_query_alter, but they don't exist.

(edit) I found now some lead that might have a solution: How to change access callback of user entity when entity module is installed? (how to make sure my alteration is the last)

0

As you already guessed the permission is checked before building the content, so you will never be able to display any user data without that permission. (At lest not without some programming.)

You could try to grant the View user profiles permission to all user and then use the Field Permissions module and grant access per field. So you can show anonymous users only the fields they should have access to.

UPDATE:

As you have pointed out the above solution introduces some problems with privacy and some additional fields not being hidden on the user profile.

So another suggestion; Remove the Views access check. Views by default bypasses access checks on content (so Views without access checks are considered unsafe). Which might be of benefit to you here. As an alternative you can set a more generic permissions such as View published content to prevent errors from modules like Security Review.

Views access check

Then under display choose Display Suite and your custom view mode.

Display Suite

You will end up with a View that shows the custom View mode with all selected fields, even for anonymous users. Yet the user profile at example.com/user/1 shows access denied for anonymous users.

Result

  • Thanks. I could also do this in Display Suite with the field access there, but, it would be not that perfect as then this will make it hard to get the other view modes of the user correct, as in some view modes the same field should be visible and in other view modes not. Also some of my fields are custom coded display suite fields that are not controlled by the field permissions module. – Hans Rossel Mar 18 '16 at 17:57
  • To give an example why this would not be a good solution: imagine a view "our team" which shows a publicly visible selection of users and displays them with the view mode "user_teaser" which shows the username and user picture. If I would grant "view user profiles" to all users and limit the visibility of all fields except these two fields, then anyone that goes to user/123 could see the username and image of every user as the view of these fields is not limited by view mode. – Hans Rossel Mar 18 '16 at 20:13
  • Please see my updated answer. – Neograph734 Mar 19 '16 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.