I have created a node photo gallery. The display of the images is provided by an EVA view. Two content types were created: One photo gallery and one image upload node. To the image node were added an image field (for uploads) and one node reference from URL field that references back to the photo gallery. The result being that when someone is viewing the gallery, there is a visible link to add an image. Clicking the link brings up the image upload widget. The user is returned to the gallery after uploading and saving the image. That works well.

All authenticated users have a photo gallery, and they can all visit the galleries belonging to others. But as it stands now, all can see the add image links on all galleries and use it to upload images to someone else's account. The reason for this being that the link is not part of the view but part of the content type (even when the view is deleted, the link still shows.) So the contextual filters in the view do not work in this case.

The link to the referenced node can be disabled in the Reference from URL field settings and could most likely be replaced by a direct link to the image upload node. But this does not prevent a smart user to upload an image to someone else's account directly from the URL.

Is there a way to implement a variety of access controls on the creation of content? All the access control modules I have seen use roles and/or view/edit/delete permission only. Core allows control of node creation but on a role basis only. The ideal would be a filter like in a view that only allows the author of the gallery to add new pictures but unfortunately the Reference from URL link is not part of a view.

Any pointer on how to solve this riddle?

Thanks. :)

1 Answer 1


The Field Permissions module allows site administrators to set field-level permissions to edit, view and create fields on any entity.

This means that you can set the Enter own value for the add image field for the authenticated user only.

The image below shows the settings screen in the module for a field named Nationality.

settings screen

  • Yes it does all that. Unfortunately, even when permissions hide the field, the link to the referenceable node still shows (this is a Node Reference from URL field) and a user can click it to get to the upload node. The field itself is on the image upload node. When permissions remove it it disappears from the image upload node preventing the user from returning to the gallery referenced by the field. But the link on the gallery is unaffected. Thank you for your suggestion though. :)
    – user14666
    Commented Jun 16, 2013 at 4:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.