0

I've got two content types. One we'll call "company"; the other, we'll call "project". Companies can have projects, managed by a field in the project. Companies and projects can also have fields that determine their visibility; each of them can be marked "public" or "private". Node access rules are used to control access to the nodes, based on the value of that field. All of this is working fine.

What I'd like to do is make it so that, if a company is marked "private", all of its projects also become private, in the sense that people other than the company's owner get access_denied if they try to look them. However, if the company's access is returned to "public", the access rights of the projects are restored to whatever their own visibility setting specifies.

Here's what works for me at the moment. My concern is that it requires directly hacking the node_access table, which, aside from the fact that it works, bothers me...

Add two bits of code to the company's _node_access_records() handler:

  • When the company's visibility changes from public to private, for each of the company's projects: blow away the entries for the project in the node_access table and insert a "only the author can access" right.
  • When the company's visibility changes from private to public, for each of the company's projects: again blow away the entries for the project in node_access, but this time get the access rights for the project by calling its node_access_records() handler and insert the corresponding rights into node_access for that project.

Any other ideas out there, perhaps something that (in particular) avoids the direct hacking of node_access?

Improve this question
3
  • Hello, and welcome to Drupal Answers. If you want to find a better way to do something, then what you are currently using is not an answer, but part of the question.
    – avpaderno ♦
    Commented Dec 9, 2012 at 7:36
  • Well, mumble. It seemed like an answer because it answered the question, so I put it there in case there were no alternatives. But @rimu's approach is much better, so I'll go with that.
    – Jim Miller
    Commented Dec 9, 2012 at 17:24
  • What you tried is necessary to answer the question, and avoid suggesting what you are already using; therefore, it is part of the question, not an answer. As dump rule: When you write an answer but end up asking another question, that is a sign that the answer is probably an edit for the question.
    – avpaderno ♦
    Commented Dec 9, 2012 at 20:29

1 Answer 1

Reset to default
1

Create a custom module.

Use hook_node_view to run some code whenever a project node is viewed.

In that custom hook, find the company nid by looking at the field of the current node.

Then use node_load to get a node object of the company, check the company's access and then call drupal_access_denied if the current user does not have access to that company.

Improve this answer
1
  • hook_node_view() should not be used to deny user the access to the node.
    – avpaderno ♦
    Commented Jan 3, 2013 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.