Entity Reference + View + security

Question

I have this scenario in DRUPAL 7

A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian).

A content type named "Reports" with a field "Student" that references to a Student.

With these reports I can do a view with 2 contextual filters (student id/date) to display a chart with the data provided from an specific report (using google chart tools).

All works like a charm, the problem is about the security because the url can be altered by anybody and get info for any student.

With Rules I can control:

• A student is visible if you are the legal guardian (or if you are an admin)
• A report is visible if you are an admin. I don't know how to control the legal guardian (in Students) of the Student field specified in this content type. But anyway, cos this information is used only to generate the charts, I don't really mind.

The problem is, as you can guess, that I need to control the access to the view. Only users that are legal guardian of student specified in that report can access the information.

All that comes into my mind is to set some rules to change the owner of the contents (Student, Reports) to the legal guardian's user and control the permissions, but maybe isn't the best way.

Could you please help me?

Answer 1

You might be able to get this to work by using the Rules module. Depending on how the format of your URLs look like, you may want to also use the Rules URL Argument module. Here is a quote about it (from its project page):

... provides two rules conditions based on URL arguments:

• check if a URL argument is present.
• compare the value of an URL argument.

It also provides an action that makes the value of an URL argument available as new variable to Rules.

The newly provided Rules actions and conditions can be found under the "URL Argument" conditions and actions groups in the rule configuration interface. Using those you might be able to build an appropriate rule to issue a redirect (+ display a message if needed) based on some Rules Conditions that implement your access restrictions.

For more details, refer to my answer to the question "How to use the Rules module to implement a custom redirect for an outdated URL?".