How to allow a role to block other users?

Question

Looks like there still isn't a great anti-spam solution for D7 ;-(

I already have flags for nodes and comments with automatic unpublish once enough users flag it.

I want to be able to give users of a certain role the permission to block other users and possibly unpublish any content of that user.

I don't see a permission for "block user". How can this be done?

Answer 1

There isn't a specific "block user" perm. Out of the box there's only the administer users perm, which in turn grants the role the ability to add/edit/remove other users. If you want a block user permission, you could define your own block user permission, then grant your custom permission to whatever user/roles you want. Here's the basic recipe:

• Implement hook_permission, and add the block_user permission there.
• Implement hook_menu_alter, and modify the 'access callback' argument for the user/%/cancel and user/%/cancel/confirm/%/% menu items to point to your own custom access callback function. You might also need to change the 'page_arguments' setting to point to your own form instead of the default, if the default user cancel form doesn't cut it for you. The default form called is user_cancel_confirm_form().
• In your custom access callback, you can use user_access() to verify that the current user/role has access to the block user permission.

Before you embark on this, you might be interested in checking out:

• The user/%/cancel and user/%/cancel/confirm/%/% entries in the menu_router database table. It tells you what are the access callbacks and all other important details of these paths.
• The user_edit_cancel_submit() function on the user.pages.inc include file. This is the Form API #submit function that gets called when you hit the Cancel button on any user user's account.
• The different account cancellation methods exposed in user_cancel_methods(), user.pages.inc. There's four cancellation methods. I think *user_cancel_block* and *user_cancel_block_unpublish* are the safest methods.

Sample code:

/**
 * Implements hook_permission.
 */
function rallen_permission() {
  $perms = array();
  $perms['block_user'] = array(
    'title' => t('Block user'),
    'description' => t('Disables accounts and hides their contents.'),
  );
  return $perms;
}

/**
 * Implements hook_menu_alter.
 */
function rallen_menu_alter(&$items) {
  $target_paths = array(
    'user/%/cancel',
    'user/%/cancel/confirm/%/%',
  );
  foreach($target_paths as $menu_item) {
    $items[$menu_item]['access callback'] = 'rallen_block_user';
  }
}

/**
 * Custom access callback for blocking users.
 */
function rallen_block_user() {
  if(user_access('block_user')) {
    return TRUE;
  } else {
    return FALSE;
  }
}

Answer 2

Sounds like you must do it by custom module.

For blocking user, use db api and just change status column (users table) value to 0.

Similar things is for unpublish selected user content. All you need is in node table.

So you need two UPDATE statement for this job. That's all.

BTW. Do you try mollom for anti-spam? You can specify any form to work with mollom. Maybe you can configure this module to work with logged in users.

Mollom has nice permission, e.g.: Bypass Mollom protection on forms, so you can choose which role may bypass spam checking or not. Then just try to find any hook declared by Mollom module that allow you to block user when spam is detected.

Answer 3

Before writing code I'll probably add a user flag to the profile that is only visible to that special rule. When you flag a user it would fire a rule to block that user.