2

I have setup a View which showscertain information to a user, when he/she is logged in provided that logged in user is referenced in the content type containing that information.

The View shows this information user the name of the uid from the url.

The website is such that the logged in user can view the profile of other users, this makes the logged in user have access to the information of the user whose profile is viewing which shouldn't be the case. Please tell me how do I prevent this?

  • what is this meaning? you want create a views show information about users but dont want another user see another info?do you want restrict views to only logged in infot?(filter by logged in user?) – Yusef Sep 6 '12 at 15:22
1

This is honestly, a question that I have faced many times. You have 2 options.

Use a path like /my_posts and then using UID argument with "logged in user" as the failback argument. This is a common wa. Modules like Flag comes with default Views that uses "logged" in user as the failback argument so it doesn't need to mess with php.

However, the ideal solution would be,

A. Add the UID argument as necessary (user reference, author, etc).

B. Set When the filter value is NOT available to Provide default value and then to User ID From URL.

image for #1 and #2

C. Check Specify validation criteria. and choose "php code".

<?php
global $user;
if ($user->uid == $argument && is_numeric($argument) && $argument >0 ){
  return TRUE;
}
?>

D. 'Action to take if filter value does not validate' => Display "Access Denied" enter image description here

Good luck!

  • Thanks for responding, I will try this out and let you know what happened. – Nana Akwasi Sep 8 '12 at 2:47
  • Welcome to SE and it's good to be the first one to answer your question and make it actually work for you. Usually, if the answer is correct, user who posted the question marks a reply and answer (seethe left top corner's tick in this question ?). It helps future Googlers and yes, my rep :) – AyeshK Sep 8 '12 at 4:02
0

Let's say for example:

You have parents who can log in to a site, and see data relating to their children.

So: you have a 'child' content type with a 'user reference' field pointing at the parent's user account.

In your View, do this:

Click 'Advanced' (top left)

Contextual Filters - Add

Find the field which contains the user reference (in my case this is called 'Parent')

WHEN THE FILTER VALUE IS NOT IN THE URL

Provide default value

Type = User ID from Logged In User <--- this is the important bit.

Save.

You can test the view at the bottom, where it says 'Preview with contextual filters' --- put the User ID of the user you want to test for.

Now, try logging in as that user, and go to the View, it should be filtered the way you need.

  • I think OP knows this, and needs to avoid user with ID 123 from accessing user/456/private_area . – AyeshK Sep 6 '12 at 15:25
  • This is what I was looking for but thanks anyway. I appreciate the support – Nana Akwasi Sep 8 '12 at 4:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.