How to COMPLETELY limit access to Views pages?

Question

I've got a content type that has attached to each of its nodes a calendar (e.g., node/123/calendar); this is generated by fullcalendar via Views. I'm setting up node access rules on that page so that some users can see the calendar and some can't. The node access is handled through the "Access:" field in Page Settings for the view, in what I think is the usual way (I'll admit to being something of a Views newbie).

This works, but (to my eyes) only sort of. If a restricted user tries to get to the page, they get the same page structure, generated by a page--node--calendar.tpl file, that they'd get if they were allowed to see the page, except that the content is the "You are not authorized to access this page" message. Thus the user is able to get some information about this restricted item, like the fact that there is a node that has a calendar attached to it. I'd prefer to have a more empty 403 or 404 error page come back, without the node-related wrappings.

Is there any way to do this? I suppose my page template could check the content it's about to display and see if it matches the access denied message, but that's a little more hackish than I'd like to get...

Answer 1

That is because Drupal, when users access a page to which they don't have access, it draws the page using its template file, and replaces its content with the error message.

What you can do is setting a page to use for the access denied page, and use a different template file for that page. In Drupal 7, that is done in admin/config/system/site-information, under Error pages.

Keep in mind that, when an access denied error is returned, the URL of the page is not changed; this means the users would still know the node has a calendar attached, if they try to access the page using the URL directly. The Calendar tab is not shown to users who don't have the permission to access it, though; they can only try using the tab URL, and see if they get an access denied error.