3

The default behaviour is that a user can't edit a node when they don't have access to its current input format, even if they do have the edit content type permission. I'd like to just hide the body field in those situations. Does anyone know of a contrib that does that? (I'm only interested in the body field, but a more general solution would be cool too.)

1

You could do it, but it would require some work.

  1. Use hook_menu_alter to change the access function used for node edits
  2. Create your own access function that is similar to core's access control, but allow users that doesn't have the filter permission to edit the node.
  3. Use hook_form_alter to hide the body field if the user can't use the selected filter
  4. You're done.

You have to be very careful about doing this, as if this isn't done right, it could potentially open for security holes.

  • Thanks - if it's that easy I'm surprised it hasn't been done already as a contrib. Will report back once done, thanks again! – Andy Jul 5 '11 at 14:42
  • 1
    Altering the access callback for these menu items is imho not much better than hacking core. a) There could be conflicts with other modules, for example some node access modules are doing this and b) In case there is a security related fix for that function (unlikely, but possible) you would have to change your function too. And there might be direct calls node_access() for example in some content listings with a direct edit link. – Berdir Jul 5 '11 at 14:58
  • @Berdir It's far from an ideal solution, my point was that it is possible without hacking core. – googletorp Jul 5 '11 at 16:06
  • @Berdir, @googletorp, thanks for your time, really appreciated. I think I'm not going to go this route, and write my own edit form for the specific bits I need the user to be able to edit. – Andy Jul 5 '11 at 16:26
  • @Berdir, @googletorp, if you have the time, would very much appreciate any feedback on the code I posted. – Andy Jul 11 '11 at 9:45
2

Not really an answer, but there is AFAIK no way to change this without hacking core.

The check for this is directly in node_access() and can't be altered.

What you are trying to do is btw how it works in Drupal 7, see the corresponding issue.

  • You can do it without hacking core. – googletorp Jul 5 '11 at 11:27
  • @Berdir wow I did a double-take when I saw the original version number on that issue! Glad it's made its way into D7. – Andy Jul 5 '11 at 14:45
0

In the end I didn't create a custom edit function, I followed googletorp's idea while trying to mitigate against the issues Berdir described. In case anyone's interested there's a module here.

  • You can't add conditionals to your menu_alter, it is cached so it will only be run once. – googletorp Jul 11 '11 at 10:43
  • @googletorp I'm aware of that, but I think it's ok in this situation. I want to be able to transparently hook into the current access callback (probably node_access but possibly not). I try to find the $node parameter (by looking for the value '1') and if I can't find it I just give up. So the conditional is basically saying, if you don't understand the current access callback, don't modify the menu item (this module fails to run, but generates a watchdog error). – Andy Jul 11 '11 at 10:50
  • for it to make sense you would need to check the first argument, since your access control function won't work if the node argument is at a different position. – googletorp Jul 11 '11 at 11:01
  • @googletorp Thanks for your attention. My access control function's designed to work wherever the node argument is. It will never be called if hook_menu_alter can't find the $node argument at all, but if it finds it as the 11th argument, everything should still work (as this index gets passed through to my access callback, along with all the original arguments for the original access callback). – Andy Jul 11 '11 at 11:12
0

You can use content permission in CCK.

  • Thanks Satya, I wasn't aware you could use content_permissions.module to hide fields on the edit screen based on their input format... if that's possible, could you describe how? – Andy Jul 18 '11 at 11:02
  • I haven't tried it.. will check and revert back. – Satya Jul 19 '11 at 5:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.