0

I cannot seem to get the role of the current user in my twig template. I have tried the following:

{{ user.getRoles }}

{{ user.hasRole('content_administrator') }}

and neither return anything.

Notes:

  • I use a subtheme of radix.
  • I want to include stuff in the theme if the user has a certain role. Specifically, I have regular viewers and a content admin, and the content admin shall see extra things. I created a view called /revisionhistory which has a contextual link, and shows revisions. The theme should generate a link to /revisionhistory/{{node.id}} if the user has the administer_content role.
  • user.getRoles should work, but you can't print the resulting array directly, you need a loop to print the roles. Or do you want to check for a role? Then try {% if 'content_administrator' in user.getroles %} – 4k4 Sep 23 '19 at 12:54
  • Which template? There are some templates that don't get the user information. You may need to add a preprocess hook to add the user object to the $variables passed to the template. – CG Monroe Sep 23 '19 at 14:43
  • I am using a subtheme of radix. – Innovine Sep 23 '19 at 14:44
  • Actually, the permission name is 'administer nodes', note the space. You can see the permission names using drush role-list (optional role name). – CG Monroe Sep 23 '19 at 14:58
  • @CGMonroe, to me this looks like the machine name of a custom role "Content Administrator". Innovine, can you clarify what you want to do? – 4k4 Sep 23 '19 at 15:06
1

Displaying content if the user has a certain role:

{% if 'content_administrator' in user.getroles %}
  <p>Only displayed for the role Content Administrator</p>
{% endif %}

More info: Restrict content to a user role in a template file

|improve this answer|||||
  • This worked fine. Was pretty sure i tried exactly this .. :/ oh well, thanks :) – Innovine Sep 24 '19 at 6:35
1

The best practice for security in Drupal development is not to use roles to determine access but to use permissions. So instead of user.hasRole(). You should use {{ user.hasPermission(permission) }}. This means the code does not have to be modified as roles are added / changed.

As in the comments, the core permission name for managing nodes is not administer_content but is 'administer nodes'. You need to make sure you are using the correct permission 'label'. However, finding permission names in Drupal is harder than it should be IMHO.

A couple of ways to do this are:

Use the drush role-list command. This lists all roles and their permission labels. You can specify a specific role to just list that one.

Alternatively, you can inspect the checkboxes in the permissions page. The permission label is buried in the name attribute in the format role[permission], e.g. anonymous[administer nodes].

Note that this will work with all permissions core and (custom) module added.

|improve this answer|||||
  • What is the drawbacks of using roles, beyond what you mentioned above. it seems like a good fit to what I want to do.. – Innovine Sep 23 '19 at 16:49
  • There are many from a security standpoint. Drupal's core and modules are based on permissions. If you have a role based filter and a permission is removed from the role, your code can potentially either show information that the user does not have access to or just break because the underlying information is denied. Additionally, role based checks require more code modifications over time. E.g., we created a sub content admin role.. now the code has to be modied to include a check for that role.. in your case, what about the admin role.. shouldn't that see the same as a content admin? – CG Monroe Sep 23 '19 at 20:04
  • Thanks for that! In my case, no, the content admin is allowed to post, edit and delete content, but not mess with the site settings, user accounts, content type definitions, etc. I keep that to a site admin role. I will take a look at switching to permission based security, thanks for the tip – Innovine Sep 24 '19 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.