0

I have a custom entity type that can be viewed by certain people only. This works just fine, when people go to "mysite.com/custom-entity/8" some can see the info, some get "access denied" error.

The problem is I created a view to display a list of those entities and all of them are shown to all users, even if certain users shouldn't have "view" access permission.

LE: Caching is set to "None"

Any ideas on how to fix this? Thanks.

7
  • This sounds like it could be a caching issue. Does this happen without caching enabled for your view?
    – sonfd
    Aug 26, 2020 at 14:49
  • Caching is set to "None" Aug 26, 2020 at 15:00
  • Is the access on the custom entity controlled by a configurable permission? Aug 26, 2020 at 19:16
  • Access is controlled by a custom access control handler just like any other Drupal entity. Aug 27, 2020 at 11:01
  • 1
    Gotcha. When you create a custom entity in Drupal you can define a permission for viewing the entity which will be managed through the standard configuration system. The benefit to that is exactly what I have outlined in my answer below: you can tie that permission to other operations on the site that you cannot affect within an access control handler. Aug 27, 2020 at 16:28

1 Answer 1

-1

Option A

Create a custom access handler for your view.

Drupal 8 - Views Custom Access with a Plugin is a great guide. It seems like your scenario may fit the use case outlined in the beginning:

"... prohibit the display of a Drupal 8 View dependent upon some custom rules that don't fit easily with Drupal's permissions model ..."

Pro: You will get exactly the control features you want.

Con: A lot of custom code.

Option B

If you want permission for viewing the entity to be directly tied to the view access, there is an "Access" section on the view configuration form. Select "Permission" and then select the permission for viewing the entity you have created.

Pro: Easy to set up.

Con: Your use case must fit into Drupal's permissions system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.