I have created a node photo gallery. The display of the images is provided by an EVA view. Two content types were created: One photo gallery and one image upload node. To the image node were added an image field (for uploads) and one node reference from URL field that references back to the photo gallery. The result being that when someone is viewing the gallery, there is a visible link to add an image. Clicking the link brings up the image upload widget. The user is returned to the gallery after uploading and saving the image. That works well.
All authenticated users have a photo gallery, and they can all visit the galleries belonging to others. But as it stands now, all can see the add image links on all galleries and use it to upload images to someone else's account. The reason for this being that the link is not part of the view but part of the content type (even when the view is deleted, the link still shows.) So the contextual filters in the view do not work in this case.
The link to the referenced node can be disabled in the Reference from URL field settings and could most likely be replaced by a direct link to the image upload node. But this does not prevent a smart user to upload an image to someone else's account directly from the URL.
Is there a way to implement a variety of access controls on the creation of content? All the access control modules I have seen use roles and/or view/edit/delete permission only. Core allows control of node creation but on a role basis only. The ideal would be a filter like in a view that only allows the author of the gallery to add new pictures but unfortunately the Reference from URL link is not part of a view.
Any pointer on how to solve this riddle?
Thanks. :)
