I'm a Drupal veteran, but this one has me stumped . . .

I have two Profile2 profiles, one for a company and one for a job seeker. In the job seeker profile, there is an entity reference field where they add companies they don't want to view their profile. The way companies finds people is by searching via Search API. Another way, would be by browsing. I need to block both ways. Basically, the job seeker should be invisible to the companies that they've blocked.

I have Panels, Panelizer, Rules, and Views all at my disposal and know how to use them, just not in this case. Or am I better going with my own custom module?

I saw this answer Hide Profile2 fields depending on it's value when viewing user profile and that's only for specific fields, I want to block the whole profile.

This question is along the same lines of mine, but I don't see a complete answer -How to filter a view based for the current user based the value of custom fields in his profile and fields in the list of items viewed

  • Hello. I can't understand why is it tagged with search-api.
    – Mołot
    Sep 12, 2013 at 8:01
  • Because one of the elements I'm trying to block is search-api. I don't want the jobseeker profile to show up even if they match other search criteria the company user has selected. Basically I tagged it with all the modules I think could provide some sort of answer. Sep 12, 2013 at 8:04

2 Answers 2


You can control profile2 access with


Views listens to node access so you might be able to use to exclude rows from the view.

 * Implements hook_profile2_access
function MY_MODULE_profile2_access($op, $profile = NULL, $account = NULL) {
  if (isset($profile)) {
    // Use wrapper for field access
    $profile_wrapper = entity_metadata_wrapper('profile2', $profile);
    // Check if $account uid is set in field_invalid_users
      if(in_array($account->uid, $profile_wrapper->field_invalid_users->raw())){
        // Deny access
        return FALSE;
    // Example: Explicitly deny access for a 'secret' profile type.
    if ($profile->type == 'secret' && !user_access('custom permission')) {
      return FALSE;
    // In other cases do not alter access.

One consideration is caching. Cache will need to vary enough to not serve the same cached content to valid and invalid users. Perhaps those pages aren't cached at all, it depends on your application.


You can add an 'access callback' function to the menu hook for the pages you want to block and inside that function perform your own checks against the currently logged in user. This also means you must block the page for anonymous users or the company can just logout and view the profile anyway.

For hiding in search results I see two options:

Easy solution

In search-result.tpl.php or hook_preprocess_search_results you check access and don't show it. Drawback is that the count of the total results wouldn't be correct anymore.

More advanced

Add an extra indexed field blockedcompanies which contains all ids of the blocked companies in Solr with hook_apachesolr_index_document_build. When searching: add a check on this field with hook_apachesolr_query_prepare.

  • What if I'm not using Soir? Right now, I'm only using the regular DB search component. There are plans for later to use Soir. Sep 12, 2013 at 9:18
  • I would strongly advice to use Solr instead of the regular DB search. It's faster, takes load off your database and is way more advanced (facets and the given solution for example). If you want to stick with the DB search, I think you'll need to use the first proposed solution. Sep 12, 2013 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.