I have a Jobs type content which include a user reference field

I have another content type called Applications which includes a node reference field that links to Jobs.

Register applicants can apply for Jobs via Applications, permissions have been set so only individual applicants can view their own applications and not anyone's else.

I want to set permissions so recruiters can only view applications to their own Job content type and not anyone's else. I can do this in views but if a recruiter knows another recruiters Application url (i.e /application/4) then the recruiter can view that application as well, in this example change the url to /application/5.

  • Are recruiters logged-in or anonymous users? Jan 3, 2017 at 14:07
  • Recruiters and applicants are registered users
    – hobbsie
    Jan 4, 2017 at 10:25
  • Is the user reference field pointing to the author/creator of the Job node? What module are you using for the node reference field that links an Application with a Job? Looking at this with interest. :-) Jan 4, 2017 at 18:14

3 Answers 3


You can do this in hook_node_access().

You didn't mentioned if this is for D7 or D8, but this hook is available in both.

This hook provides the node and the account object. So you have all data you need to calculate the permission.

  • I am using Drupal 7
    – hobbsie
    Jan 4, 2017 at 10:29

This can be done using rules.

For example.

Content is viewed of type Application

Compare the author id of the node in the referenced field with current user id.

If it matches, you can redirect to the home page or can do what ever you want to do at this point.

enter image description here

Here is the exported rule which is working.

{ "rules_acces_own_job_applications" : {
"LABEL" : "Acces Own Job Applications",
"PLUGIN" : "reaction rule",
"OWNER" : "rules",
"REQUIRES" : [ "rules" ],
"ON" : { "node_view--application" : { "bundle" : "application" } },
"IF" : [
  { "NOT data_is" : {
      "data" : [ "node:field-job:author:uid" ],
      "value" : [ "site:current-user:uid" ]
"DO" : [ { "redirect" : { "url" : [ "site:url" ] } } ]

Okay, so here is an answer using only Views.

The following requirements were identified in the OP:

  1. A recruiter creates a Job node
  2. An applicant creates an Application for a specific job (linked from Application to the Job using an entity reference field).
  3. A recruiter should see all Applications for a Job, only if she created the Job node.

You need to do the following:

  1. Create a View that displays Nodes of Type = Jobs.
  2. Add the Node's ID as a Contextual Filter to the View
  3. Add one "Content: Author" relationship to your View, make it mandatory and name it recruiter. This will allow you to use the current user as a filter.
  4. Add a "User: Current" filter to your view, selecting the currently logged-in user to match the content's (in this case Job) author and the "recruiter" relationship.

At this point, your View, running via a URL like "/applications-for-job/4" should allow recruiters to see a list of their jobs only and no one else's.

  1. Add a relationship - a reverse one - "Entity Reference: Referencing entity" to your view, to link Jobs to the Applications that point to them. Make this mandatory. It should come with a name like "Content referencing Content from field_job".
  2. Add a second "Content: Author" relationship and this time set it up to use the relationship from step 5. Makes this mandatory. You can call this "applicant".
  3. Configure your fields to use the relationship from step 5, so that Application data are displayed; optionally add user data to your fields and use the "applicant" relationship for these.

You should have what you asked for by now, a recruiter can only view Applications for a specific Job, only if here created that Job, by visiting the URL "/applications-for-job/JOB_NID".

Here is a screenshot of the finished View for reference:

enter image description here

Best of luck!

  • I manged to get it working to step 4 but not for steps 5-7 I'm not sure what I'm doing wrong
    – hobbsie
    Jan 6, 2017 at 9:11
  • Sounds good, let's see how to get steps 5-7 working; How does your view config page differ from mine? Are you using the Entityreference module for linking Applications to Jobs? What didn't work for you in steps 5-7? Jan 6, 2017 at 9:55
  • I'm using Node reference and widget Reference from URL to link applications to jobs. I'm not seeing any node referencing/ed in views relationships but I'm seeing Entity Reference: Referencing entity A bridge to the Content entity that is referencing/ed Content via field_application. When I add step 5 (Entity Reference: Referencing entity) everything disappears and nothing shows when I complete 6-7
    – hobbsie
    Jan 6, 2017 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.