0

I have Views Data Export installed, which creates a CSV file attached to every node. This file has all of the data from a field collection field arranged as a CSV.

The only user that should be able to download this CSV file is the admin (user 1) and the user that created the node.

In Views Data Export, I can select Role as a permission, and assign it to all "Managers", but that means each "Manager" can download other Managers data if they get the URL right. Anyone wanting to maliciously steal data, or sneak a peak at how much their colleagues are earning can simply guess the URL of the CSV file.

How would I restrict this download to the author of the node?

I have tried installing Path Rules, and creating a Rule that checks that the path of the CSV ends with CSV, and then runs a condition to check that the Nid of the currently logged in user matches one created by the author, but the download happens automatically regardless. There doesnt seem to be a path check before it is downloaded.

Stuck here scratching my head, would welcome even the slightest suggestion, or just a fresh pair of eyes! Thanks.

OK, some progression...

I delved into creating a views custom access like so...

Added files[] = couples_page_custom_access_plugin.inc to a custom module info file

Added the following to couples_page_custom_access_plugin.inc

<?php

  /**
   * Access plugin that provides property based access control.
   */
  class couples_page_custom_access_plugin extends views_plugin_access {

    function summary_title() {
      return t('Couples Page Check User is Author');
    } // summary_title()

  /**
   * Determine if the current user has access or not.
   */
    function access($account) {    
      return couples_page_custom_access($account);
    }

    function get_access_callback() {
      return array('couples_page_custom_access', array()); 
    }

  }

Then added this to a custom module...

  function couples_page_custom_views_plugins() {
    $plugins = array(
      'access' => array(
        'test' => array(
          'title' => t('Couples Page Check User is Author'),
          'help' => t('this is a custom access plugin'),
          'handler' => 'couples_page_custom_access_plugin',
          'path' => drupal_get_path('module', 'couples_page_custom'),
        ),
      ),
    );
    return $plugins;
  }

  function couples_page_custom_access($account = NULL) {
    global $user;
    $access = false; 
    $account = user_load($user->uid);
    $node = node_load(arg(1)); // Get the nid from the URL of the CSV file.

    // If the UID of the currently logged in user matches the UID of the node author return true.
    if ($account == $node->uid) {
      $access = true; 
    }
    return $access;

  }

But its not really working. If I set $access = true it works, and $access = false, it doesnt, so I know the plugin is working. It must be the logic in the last bit here...

function couples_page_custom_access($account = NULL) {
        global $user;
        $access = false; 
        $account = user_load($user->uid);
        $node = node_load(arg(1)); // Get the nid from the URL of the CSV file.

        // If the UID of the currently logged in user matches the UID of the node author return true.
        if ($account == $node->uid) {
          $access = true; 
        }
        return $access;

      }

Perhaps I am not getting the author uid of that node correctly? I will look into it.

0

I found the problem.

I was using user_load() in an earlier example, and was still using it rather than the uid.

The final access check should be...

function couples_page_custom_access($account = NULL) {
    global $user;
    $access = false; 
    $node = node_load(arg(1)); // Get the nid from the URL of the CSV file.

    // If the UID of the currently logged in user matches the UID of the node author return true.
    if ($user->uid == $node->uid) {
      $access = true; 
    }
    // Else check if the current user is admin so we can download what we like.
if (in_array('Admin', $user->roles)) {
  $access = true;
}
    return $access;

  }

I also added a check to return true if the current user is an Admin.

I really hope this helps someone else, and saves the time it took me to get to this!

Still, every days a school day!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.