0

Is there anything in Drupal's security like Plone's Dexterity where I can wrap content in my webpage and have it displayed or not displayed based upon security roles?

EDIT: Thanks. None of these do what I'm asking, however. I want to wrap a piece of content on a webpage and based upon the user hide or display it,

<? if user in group or role x (?>
<input type=buttong value="approve employee for vacation time" />
<? else ?>
<strong>Supervisor not approved yet</strong>
<?)?>

Don't get hung up on vacation. I'm not looking for a workflow. It could have said anything. Show DOB, SSN, etc

I have to query outside databases like Oracle, SQL Server, and so on to get this information. It will not be resident in the Drupal database, only the security will be.

|improve this question
  • I am not familiar with plone but drupal has some pretty granular roles and permissions in core and there are a ton of other access controls modules down to the field level. – Nigel Waters Aug 16 '13 at 21:38
  • @Letharion Can I wrap content in the webpage itself to do what I'm asking? Have you seen any examples of this? Example code? – johnny Aug 17 '13 at 15:29
  • I think he deleted his comment. – johnny Aug 17 '13 at 15:29
  • I changed it to an answer instead. Yes you can, but that's a bad idea, as I've written about in the answer below. – Letharion Aug 17 '13 at 15:32
  • For what it's worth Dexterity doesn't appear to be security related at all. – Letharion Aug 17 '13 at 15:43
4

Drupal has a powerful access control to allow users, site builders and developers grant or deny access to content created in it. The basic of access control is the triplet user-group-permission, where you have users associated to roles associated to permissions.

There's a lot of Drupal contributed modules to extend these features. Content Access is a cool module to restrict content to some roles based on it's own type. Domain Access is another control acccess module, a lil more complicated, which handle the access control to affiliate content to "subsites" (domains, subdomains or non-standard ports). So, if you make a little search in the Modules page of drupal.org for "ACL", "access control" or something like, you'll find a lot of resources to bootstrap your web software development.

Keep drupalizing!

|improve this answer
3
<?php if user in group or role x ?>

translates to 

user_access("some permission")

once you've assigned the permission to an appropriate role.

See user_access().

However, mixing permission checks into your content seems like an obvious error, and should be avoided.

Instead you should employ something like Panels and Page manager to push the access permission to a much earlier stage in the page build, and keep access control separate from your content templates.

|improve this answer
  • So you are saying to do it in the query before it ever gets to the presentation? – johnny Aug 17 '13 at 15:37
  • 1
    I don't know where the query came into the picture. I'm saying you should follow the principle of separation of concerns. Access control should be a step on it's own, not mixed in to content or other queries than those necessary for the access itself. And yes, that's before the presentation. – Letharion Aug 17 '13 at 15:40
0

If i understood you correctly the module you need is Content Access. It allows to filter content per role and more.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.