I have a client having website in Drupal . He need to create user and want to assign rights for edit and delete on every column displayed in webpage. I have tried ACL but that didn't work, so Iam planing to have my own code and tables in DB to save table and column permission for each user. But my senior told me that this is security compromise and advise me to use ACL.

What is security risk and what issues can be raised in future if I use my own code and tables to do the job? Plz help me understand this .

Also recommend me how to use ACL or some other work for this scenario....


You should use a specific ACL module for Drupal, such as Content Access.

The ACL module does nothing on its own:

The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. It has no UI of its own and will not do anything by itself; install this module only if some other module tells you to.

Here are basic instructions for setting up the permissions, content types and content access:

  1. Install Content Access module. Note: you will be asked to rebuild the content access permissions. If you have a lot of content on your site, this action may take a while.
  2. Create necessary user roles at Admin -> People -> Permissions -> Roles
  3. Create necessary content types.
  4. Go to: Admin -> Structure -> Content types -> Edit [Your content type] -> Access Control tab
  5. You can there setup specific permissions for viewing, editing or deleting nodes according to the group a user belongs to.

To elaborate more the security risks in handling permissions manually: your senior is right - it is always better to have a centralized system which will manage access control on a website. This way maintenance is easier and you do not need to predict all possible outcomes in order to prevent access to sensitive data at all places.
At some points in custom implementation you might reinvent the wheel, which is completely unnecessary, especially if you can already use an existing framework for setting up those rules.

Imagine the following situations: you blocked direct access to particular nodes using a custom module. What happens if a user goes to /node page and your node is listed there? RSS feed page? What happens on category pages? What happens if you use a contributed module which shows nodes and might possibly expose your sensitive data? What if the modules are updated with a security bugfix and you need to update all your code?
If you are writing those rules manually, you would need to write a solution for all possibilities and still you/someone else be able to maintain that.
Not all problems will be solved by using centralized system, but the risk is significantly reduced; all third party modules are made according to that system. You can call it a convention.

By saying that you want them to be able to edit a column I guess that you are speaking about nodes. If this is not what you mean, elaborate your question a bit more.


Not totally sure what you mean by columns either, but if you are referring to fields on an entity, you can use Field Permissions (https://www.drupal.org/project/field_permissions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy