Hi! I had the idea for this module last week while working on my current project. Actually, the client didn't request I make, but the issue was bothering me, so I wrote this on my time. In the project, there are 22 content types, but only three are ever accessed on aliased node/[nid] URLs. The rest are visible within panels or views and shouldn't be directly accessed. Problem is, Search indexes and lists everything. There are modules available to block content types from indexing or search, but I want the data available. This module allows nodes to be indexed and displayed in search, but when accessed the anonymous user is redirected to the correct location/URL. A hook_url_outbound_alter() function is included, but disabled by default. When enabled, the displayed URLs are also corrected.
I've wanted to get project permission since the wild west days of CVS, but I haven't been able to focus on it until now. Most modules I write are theming customization, and custom functionality for client sites. Whenever reasonable write them so they could be cleaned up and made into real d.o. projects. This is the first (of hopefully many) that I've been able to spend the time on.
Description
Some content/nodes should never be viewed directly; only visible through something else such as Views, or Panels. Per-content type or per-node, this module denies access to node/[nid] URLs while allowing the content to stay published and otherwise viewable.
Status
The 7.x-1.1 & master branches are the current version.
Functionality (7.x-1.1)
- Creates a permission per content type which when disabled denies node view to the specified role.
- Adds an option to content type edit forms for administrators to select the result of a direct node view.
- Node view options are Allow, Access Denied, and Redirect.
- Redirect URL/path can use tokens, an anchors or get variables.
- "Denied action setting per-node" in content type settings. Node default is to use content type default.
- hook_url_outbound_alter() implementation to rewrite URLs of denied nodes to the redirect URL.
- Simpletests for content type settings, node settings, and hook_url_outbound_alter().
Project URL: http://drupal.org/sandbox/eosrei/1140888
Comments
Comment #1
joachim commentedThat's certainly a common use-case.
The problem with using hook_node_access is that technically that will also block display of the node in panels, views, and the like.
Also, I wonder whether this ends up duplicating other node access modules that already exist.
Comment #2
13rac1 commentedI haven't found anything to provide the functionality, especially implementing hook_url_outbound_alter(). I created the module because I couldn't figure out a way to do it without writing a module.
RE: The use of hook_node_access()
arg(0) must be node, and arg(1) must be the node ID. The only panel it would block is the system /node/%node page, but it probably shouldn't be enabled for nodes handled by panels. FYI: I broke the if statement into two if statements to reduce overall site function calls/cpu cycles (though I am sure that choice be argued, and tested.)
Comment #3
13rac1 commentedAdded a demo site link to the project page. Tried to keep it simple while still showing important features.
Demo site at: http://dnv.eosrei.net/
Comment #4
13rac1 commentedAdded initial Rules module integration: Event - Node view denied to user.
Comment #5
13rac1 commentedAfter using this module on three sites, I've decided "Block direct view" is a more descriptive name than "Disable node view". I'll update the demo site tomorrow.
Comment #6
joachim commentedCan you compare http://drupal.org/node/1136292 please?
Comment #7
13rac1 commentedHmm... I saw that project application a week or so after my submission. He beat me to posting by a few days.
Result when a "Views only" node is accessed:
IMO, the Block direct view result is far more useful and user friendly.
Comment #8
joachim commentedThe thing is, we want to avoid having two modules that do pretty much the same thing, because it makes it much harder for users of Drupal to figure out which modules they should use.
The thing to do now would be for you to get in touch with that other maintainer and discuss working together to combine the best parts of both your projects into the one.
Comment #9
13rac1 commentedI've been working with Drupal for three years now, so I am totally aware of the issue of not duplicating functionality between modules. I was quite frustrated to see a module was posted a few days before mine with similar functionality. Considering this process is for developer review, and Internal Nodes provides none of the features I needed, I left my application as-is.
I'll contact the other developer, though I am not sure how our modules could be integrated.
I am implementing the two missing features, 404 and node status, in Block direct view.
Comment #10
13rac1 commentedNew features:
Fixed:
I decided against implementing "404 File Not Found" functionality. It doesn't make sense to me. These nodes exist, but access to them is denied, therefore, they should be blocked with a 301/403 and not 404. If a good case for 404 is presented, I'll reconsider.
Comment #11
mjpa commentedHaving looked at your module and reasons for making it, I think they do similar things (access control for direct access only) but differ in what they want to achieve.
My module is for making nodes fully for internal use only and those nodes are never intended to be viewed directly by anyone (other than those that need to edit them) which is why i went for a 404 instead of 403.
I like your comparison table although would disagree with having a "working" git master branch as other modules don't provide the code in the master branch - it isn't obvious what version you're getting as the info file won't contain a version number.
As for resolution, I would prefer to keep control of my module (and I assume you would want to keep control of yours) but I think they differ a bit too much and if integrated would end up with a "which way do you want to handle these nodes" type setting. I'm happy to leave it up to the reviewing people or those that grant git access to decide what happens.
Comment #12
13rac1 commentedOk. I would still use 403 for non-accessible nodes, but I understand your reasoning for 404. I'm sure people would rather have the choice.
Issue is, Block direct view already has a per-node and per-content type "How do you want to handle this?" setting. Current options are Allowed, 403, and 301. It wouldn't be difficult to add a replacement node_load() function to handle 404 at the menu level.
I'd like to also, but Joachim has explained what must happen: Highlander rules apply. You and I need to decide the result; at least Sean Connery isn't chasing us with a sword. Only one of these can become an actual d.o project, but we can both be maintainers.
Reviewers: If mjpa and I combine our modules, and the result is approved, would we both gain Project create permission? IMHO, we've both put forth the required time and effort. Thanks!
Comment #13
sreynen commentedSubscribing, as I'm already involved in the related application.
Comment #14
mjpa commentedAfter checking with some of the code review people, it appears we both could be granted project creation permissions if we merge the 2 modules.
If we are both given project create permissions and we merge the 2 modules (probably my code into yours) and we both become maintainers then that'll be fine by me.
Comment #15
FergalMohan commentedSubscribing +1
Comment #16
shadcn commentedtesting and subscribing
Comment #17
mjpa commentedAre you still interested in merging projects / getting this approved eosrei?
Comment #18
13rac1 commentedYes. I was on a two week vacation and just started a new job. I hope to have time to deal with this again next week.
Comment #19
13rac1 commentedTook me longer than I'd hoped to get back to this, but it is ready.
I implemented a 404 action using menu_get_item_alter() modifying the page_callback. Simpletests have been updated and all pass.
Comment #20
13rac1 commentedUpdated demo site with new version and new name. http://bdv.eosrei.net/
Comment #21
sreynen commentedeosrei, you said before you're interested in merging projects, but it sounds like you're doing updates to your project instead.
To clarify, making the projects more similar doesn't actually help move either forward, since it makes duplicate projects a greater concern. It would be more useful to stop working on two separate projects and focus your effort on a combined project. Since the other application has already been reviewed, I suggest starting there.
Comment #22
13rac1 commentedI was asked to combine the projects, so I did. I added the 404 feature from Internal nodes into Block direct view. I did exactly what mjpa and I discussed doing. I don't understand how else I can the combine projects. I didn't copy the Internal nodes node_load() replacement method because it causes PHP notices on my testing/development site. Instead, I researched and implemented a method which doesn't cause any notices.
What else do you want me to do? Should I make a new project? Should I add mjpa as a maintainer to this project? I had planned to, but haven't heard back from him yet.
Comment #23
13rac1 commentedI've added mjpa as a maintainer to the Block direct view project.
Comment #24
sreynen commentedNow that mjpa is a maintainer on both projects, I've granted mjpa access to promote projects to full projects. I trust mjpa and eosrei can work out which project they both want to promote. Please do not promote both projects.
eosrei, now that mjpa can promote your project, I'm going to close your application. If you need to promote another project in the future, please open a new application and reference these so we can do it faster next time.
Thank you both for your patience with this process.
Comment #25
13rac1 commentedsreynen: It was agreed that both mjpa and I would receive the promote project permission. I've shown my ability in every way requested in order to earn the permission. Yet mjpa receives the permission alone?
This module completely follows the coding standards, employs best practices, shows many examples of the module hook system, is integrated with rules, and provides significant simpletests. All the things I understood this application process is meant to test. I am disheartened by this.
Comment #26
sreynen commentedeosrei, sorry, I wasn't aware of that agreement. Your module may pass review, but no one has reviewed it yet. My closing of the issue was not intended as a review of your project. I simply assumed you no longer needed access to create full projects now that mjpa can promote your project.
If you still want to go through the review process, you're welcome to do that.
Comment #27
tim.plunkettI reviewed both the deprecated sandbox, as well as the resulting combined internal_nodes, and eosrei is certainly qualified to promote full projects (especially considering his graciousness in deprecating his own module). I'm granting him that ability, no need for him to go through another issue like this.
Comment #28
13rac1 commentedThanks a lot Tim! I really appreciate it.