I have setup a View which showscertain information to a user, when he/she is logged in provided that logged in user is referenced in the content type containing that information.
The View shows this information user the name of the uid from the url.
The website is such that the logged in user can view the profile of other users, this makes the logged in user have access to the information of the user whose profile is viewing which shouldn't be the case. Please tell me how do I prevent this?
This is honestly, a question that I have faced many times. You have 2 options.
Use a path like /my_posts and then using UID argument with "logged in user" as the failback argument.
This is a common wa. Modules like Flag comes with default Views that uses "logged" in user as the failback argument so it doesn't need to mess with php.
However, the ideal solution would be,
A. Add the UID argument as necessary (user reference, author, etc).
B. Set When the filter value is NOT available to Provide default value and then to User ID From URL.
C. Check Specify validation criteria. and choose "php code".
<?php
global $user;
if ($user->uid == $argument && is_numeric($argument) && $argument >0 ){
return TRUE;
}
?>
D. 'Action to take if filter value does not validate' => Display "Access Denied"
Good luck!
Let's say for example:
You have parents who can log in to a site, and see data relating to their children.
So: you have a 'child' content type with a 'user reference' field pointing at the parent's user account.
In your View, do this:
Click 'Advanced' (top left)
Contextual Filters - Add
Find the field which contains the user reference (in my case this is called 'Parent')
WHEN THE FILTER VALUE IS NOT IN THE URL
Provide default value
Type = User ID from Logged In User <--- this is the important bit.
Save.
You can test the view at the bottom, where it says 'Preview with contextual filters' --- put the User ID of the user you want to test for.
Now, try logging in as that user, and go to the View, it should be filtered the way you need.
