1

I want to control the access of a page based on the user ID and the value of some other fields.

For example, if I am logged in as user #5, I have access to user/5 but I don't have user to the page user/6 and administrator users have access to both pages.

In my case, imagine I have a custom user page and I want to give access only to the owner and to the user selected in a custom field.

I don't think I can achieve that using permissions and in the future I might have more restrictions based on the value of other fields. So ideally, I would like to have a function where I will get the uid and the value of the fields, I will do my checks and I will restrict the access or not.

By the way my pages are panel pages not nodes.

Any idea/help/suggestion?

Improve this question
2
  • The permission that makes that work is "access user profiles". You'd have to override the access control on this route to modify the behavior. The user account would need a user reference field added to determine who is granted access.
    – Kevin
    Commented Aug 24, 2017 at 13:30
  • Thank you @Kevin. Maybe I was not clear enough. I don't want to give specific access to the user profile pages. I have three different panel pages which consist of entity forms and views. Those pages (panel pages) should be accessible by the creator of the nodes (attached to the panel page) and an extra user who is assigned in each node in an entity reference field. The path for my panel includes the webform submission id. So what I want to do is a function where I will get the sid, fetch the user details form there and select if the user will have access or not. Don't know if that make sense
    – Ismini
    Commented Aug 24, 2017 at 14:08

2 Answers 2

Reset to default
0

You will probably need to add a custom hook_node_access code. In this you can use the view operation to check:

  • Is the current user the owner (yes - done - allow access)
  • Is the user an admin (yes - done - allow access)
  • Does the node have your user access list field (No -done - allow access)
  • Is the current user's uid in the field values? (Yes - allow access / No -deny access)

This should handle the basic access issues. You may need to look at how to hide / show links based on access as well.

Improve this answer
1
  • Thank tou @CG Monroe. I tried it but the problem is that this applies on nodes and not to panel pages. So I can't restrict the access to the panel page.
    – Ismini
    Commented Aug 24, 2017 at 15:23
0

I managed to find the solution after long time!

What I really needed was the hook_entity_access.

As I'm working with panel pages it was pointless to use hook_node_access and I also wanted to have some checks to the url parameters.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.