How to disallow selected roles to edit node titles?

Question

In project I have a content type that the owner only allows to edit some fields. I used the Field Permissions module in order to configure field edit permission and it works fine in fields.

But this module doesn't support permissions for the "TITLE" field. In my project the default users & roles don't have permission to edit title and some fields.

Any recommendations for a solution for this issue?

Answer 1

You could use the Title module

This converts the Title to fields API and should work with permissions as well. Basically it replaces the node title with a field

Answer 2

You could use the WikiTools module.

Among its features:

Move Protection: Disallow change of node titles for users without administer nodes permission.

While it is only in alpha for D7, I am using it to protect titles on several sites, and have not experienced any problems.

Answer 3

Implementing such restrictions is pretty forward by using the Rules module. Here are the highlights of how to do so:

• Don't allow updates to the title of a node of type "Article" (replace by any other type you want).
• But do allow users with a specific role (such as "administrators", but it can be any role) anyhow. So updates to the title should be allowed by such role (only).
• If an attempt to update a title of an article is discovered by a user who does not have the administrator role, then just ignore the attempted update to the title (but do save all other updates to the node).

To implement this scenario, just use this rule for it:

{ "rules_verify_updates_to_node_title" : {
    "LABEL" : "Verify updates to node title",
    "PLUGIN" : "reaction rule",
    "ACTIVE" : false,
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "node_presave--article" : { "bundle" : "article" } },
    "IF" : [
      { "NOT user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "3" : "3" } }
        }
      },
      { "NOT data_is" : { "data" : [ "node-unchanged:title" ], "value" : "[node:title]" } }
    ],
    "DO" : [
      { "drupal_message" : {
          "message" : "Tampering rejected ... An attempt to update the title of node with ID \u0022[node:nid]\u0022 was discovered (from \u0022[node-unchanged:title]\u0022 to \u0022[node:title]\u0022), by user \u0022[site:current-user]\u0022, who does not have the authorization to do so. The attempted update of the title has not been saved (all other updates were applied).",
          "type" : "error"
        }
      },
      { "data_set" : { "data" : [ "node:title" ], "value" : "[node-unchanged:title]" } }
    ]
  }
}

If somebody who is not an administrator (the role that corresponds to role id = "3") tries the above scenario (with the above rule enabled), that user will get a Drupal error message similar like this one:

Tampering rejected ... An attempt to update the title of node with ID "X" was discovered (from "Original title of this article" to "Attempted update of title of this article"), by user "Some.Userid", who does not have the authorization to do so. The attempted update of the title has not been saved (all other updates were applied).

Obviously, X and Some.Userid will be replaced by the actual node ID and username.

Works like a charm ... Similar approach for any other node property ... And straight forward to apply for any other content type (instead of "Article"), or just all content types.