I have this scenario in DRUPAL 7
A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian).
A content type named "Reports" with a field "Student" that references to a Student.
With these reports I can do a view with 2 contextual filters (student id/date) to display a chart with the data provided from an specific report (using google chart tools).
All works like a charm, the problem is about the security because the url can be altered by anybody and get info for any student.
With Rules I can control:
- A student is visible if you are the legal guardian (or if you are an admin)
- A report is visible if you are an admin. I don't know how to control the legal guardian (in Students) of the Student field specified in this content type. But anyway, cos this information is used only to generate the charts, I don't really mind.
The problem is, as you can guess, that I need to control the access to the view. Only users that are legal guardian of student specified in that report can access the information.
All that comes into my mind is to set some rules to change the owner of the contents (Student, Reports) to the legal guardian's user and control the permissions, but maybe isn't the best way.
Could you please help me?