Hi! I had the idea for this module last week while working on my current project. Actually, the client didn't request I make, but the issue was bothering me, so I wrote this on my time. In the project, there are 22 content types, but only three are ever accessed on aliased node/[nid] URLs. The rest are visible within panels or views and shouldn't be directly accessed. Problem is, Search indexes and lists everything. There are modules available to block content types from indexing or search, but I want the data available. This module allows nodes to be indexed and displayed in search, but when accessed the anonymous user is redirected to the correct location/URL. A hook_url_outbound_alter() function is included, but disabled by default. When enabled, the displayed URLs are also corrected.

I've wanted to get project permission since the wild west days of CVS, but I haven't been able to focus on it until now. Most modules I write are theming customization, and custom functionality for client sites. Whenever reasonable write them so they could be cleaned up and made into real d.o. projects. This is the first (of hopefully many) that I've been able to spend the time on.

Description

Some content/nodes should never be viewed directly; only visible through something else such as Views, or Panels. Per-content type or per-node, this module denies access to node/[nid] URLs while allowing the content to stay published and otherwise viewable.

Status

The 7.x-1.1 & master branches are the current version.

Functionality (7.x-1.1)

  • Creates a permission per content type which when disabled denies node view to the specified role.
  • Adds an option to content type edit forms for administrators to select the result of a direct node view.
  • Node view options are Allow, Access Denied, and Redirect.
  • Redirect URL/path can use tokens, an anchors or get variables.
  • "Denied action setting per-node" in content type settings. Node default is to use content type default.
  • hook_url_outbound_alter() implementation to rewrite URLs of denied nodes to the redirect URL.
  • Simpletests for content type settings, node settings, and hook_url_outbound_alter().

Project URL: http://drupal.org/sandbox/eosrei/1140888

Comments

joachim’s picture

That's certainly a common use-case.

The problem with using hook_node_access is that technically that will also block display of the node in panels, views, and the like.

Also, I wonder whether this ends up duplicating other node access modules that already exist.

13rac1’s picture

Component: module » new project application

I haven't found anything to provide the functionality, especially implementing hook_url_outbound_alter(). I created the module because I couldn't figure out a way to do it without writing a module.

RE: The use of hook_node_access()

function disable_node_view_node_access($node, $op, $account) {
  if ($op == 'view') {
    // Check if user doesn't have access and we are viewing the node view alone.
    if (!user_access('access ' . $node->type . ' node view', $account) &&
        arg(0) == 'node' && arg(1) == $node->nid) {

arg(0) must be node, and arg(1) must be the node ID. The only panel it would block is the system /node/%node page, but it probably shouldn't be enabled for nodes handled by panels. FYI: I broke the if statement into two if statements to reduce overall site function calls/cpu cycles (though I am sure that choice be argued, and tested.)

13rac1’s picture

Added a demo site link to the project page. Tried to keep it simple while still showing important features.

Demo site at: http://dnv.eosrei.net/

13rac1’s picture

Component: new project application » module

Added initial Rules module integration: Event - Node view denied to user.

13rac1’s picture

Title: Disable Node View » Block direct view
Component: new project application » module

After using this module on three sites, I've decided "Block direct view" is a more descriptive name than "Disable node view". I'll update the demo site tomorrow.

joachim’s picture

Status: Needs review » Needs work

Can you compare http://drupal.org/node/1136292 please?

13rac1’s picture

Hmm... I saw that project application a week or so after my submission. He beat me to posting by a few days.

Feature Internal nodes Block direct view
Per content type settings Yes Yes
Per node settings No Yes
404 (File not found) response Yes No
403 (Access Denied) response No Yes
301 (Redirect) response No Yes
Notice of node status Yes Yes (just added)
Redirect path with tokens No Yes
Rewrite node URLs to redirect URL - hook_url_outbound_alter() No Yes
Simpletests No Yes (151 passes)
Rules module integration No Yes (Node view denied)
Working git master No Yes
Doxygen @file blocks No Yes

Result when a "Views only" node is accessed:

  • Internal Nodes - 404 Not found
  • Block direct view - 301 Redirect to the correct Views URL, using GET variables and anchors.

IMO, the Block direct view result is far more useful and user friendly.

joachim’s picture

Status: Needs work » Needs review

The thing is, we want to avoid having two modules that do pretty much the same thing, because it makes it much harder for users of Drupal to figure out which modules they should use.

The thing to do now would be for you to get in touch with that other maintainer and discuss working together to combine the best parts of both your projects into the one.

13rac1’s picture

I've been working with Drupal for three years now, so I am totally aware of the issue of not duplicating functionality between modules. I was quite frustrated to see a module was posted a few days before mine with similar functionality. Considering this process is for developer review, and Internal Nodes provides none of the features I needed, I left my application as-is.

I'll contact the other developer, though I am not sure how our modules could be integrated.

I am implementing the two missing features, 404 and node status, in Block direct view.

13rac1’s picture

New features:

  • Added node status message and bdv-denied class for users with permission to view blocked nodes
  • Streamlined hook_node_*() functions

Fixed:

  • Removed AJAX Redirect URL field from settings form to remove Drupal core patch requirement.

I decided against implementing "404 File Not Found" functionality. It doesn't make sense to me. These nodes exist, but access to them is denied, therefore, they should be blocked with a 301/403 and not 404. If a good case for 404 is presented, I'll reconsider.

mjpa’s picture

Having looked at your module and reasons for making it, I think they do similar things (access control for direct access only) but differ in what they want to achieve.

My module is for making nodes fully for internal use only and those nodes are never intended to be viewed directly by anyone (other than those that need to edit them) which is why i went for a 404 instead of 403.

I like your comparison table although would disagree with having a "working" git master branch as other modules don't provide the code in the master branch - it isn't obvious what version you're getting as the info file won't contain a version number.

As for resolution, I would prefer to keep control of my module (and I assume you would want to keep control of yours) but I think they differ a bit too much and if integrated would end up with a "which way do you want to handle these nodes" type setting. I'm happy to leave it up to the reviewing people or those that grant git access to decide what happens.

13rac1’s picture

Ok. I would still use 403 for non-accessible nodes, but I understand your reasoning for 404. I'm sure people would rather have the choice.

... if integrated would end up with a "which way do you want to handle these nodes" type setting.

Issue is, Block direct view already has a per-node and per-content type "How do you want to handle this?" setting. Current options are Allowed, 403, and 301. It wouldn't be difficult to add a replacement node_load() function to handle 404 at the menu level.

I'm happy to leave it up to the reviewing people or those that grant git access to decide what happens.

I'd like to also, but Joachim has explained what must happen: Highlander rules apply. You and I need to decide the result; at least Sean Connery isn't chasing us with a sword. Only one of these can become an actual d.o project, but we can both be maintainers.

Reviewers: If mjpa and I combine our modules, and the result is approved, would we both gain Project create permission? IMHO, we've both put forth the required time and effort. Thanks!

sreynen’s picture

Subscribing, as I'm already involved in the related application.

mjpa’s picture

After checking with some of the code review people, it appears we both could be granted project creation permissions if we merge the 2 modules.

If we are both given project create permissions and we merge the 2 modules (probably my code into yours) and we both become maintainers then that'll be fine by me.

FergalMohan’s picture

Subscribing +1

shadcn’s picture

testing and subscribing

mjpa’s picture

Are you still interested in merging projects / getting this approved eosrei?

13rac1’s picture

Yes. I was on a two week vacation and just started a new job. I hope to have time to deal with this again next week.

13rac1’s picture

Took me longer than I'd hoped to get back to this, but it is ready.

I implemented a 404 action using menu_get_item_alter() modifying the page_callback. Simpletests have been updated and all pass.

13rac1’s picture

Updated demo site with new version and new name. http://bdv.eosrei.net/

sreynen’s picture

eosrei, you said before you're interested in merging projects, but it sounds like you're doing updates to your project instead.

To clarify, making the projects more similar doesn't actually help move either forward, since it makes duplicate projects a greater concern. It would be more useful to stop working on two separate projects and focus your effort on a combined project. Since the other application has already been reviewed, I suggest starting there.

13rac1’s picture

I was asked to combine the projects, so I did. I added the 404 feature from Internal nodes into Block direct view. I did exactly what mjpa and I discussed doing. I don't understand how else I can the combine projects. I didn't copy the Internal nodes node_load() replacement method because it causes PHP notices on my testing/development site. Instead, I researched and implemented a method which doesn't cause any notices.

What else do you want me to do? Should I make a new project? Should I add mjpa as a maintainer to this project? I had planned to, but haven't heard back from him yet.

13rac1’s picture

I've added mjpa as a maintainer to the Block direct view project.

sreynen’s picture

Status: Needs review » Closed (duplicate)

Now that mjpa is a maintainer on both projects, I've granted mjpa access to promote projects to full projects. I trust mjpa and eosrei can work out which project they both want to promote. Please do not promote both projects.

eosrei, now that mjpa can promote your project, I'm going to close your application. If you need to promote another project in the future, please open a new application and reference these so we can do it faster next time.

Thank you both for your patience with this process.

13rac1’s picture

Status: Closed (duplicate) » Needs review

sreynen: It was agreed that both mjpa and I would receive the promote project permission. I've shown my ability in every way requested in order to earn the permission. Yet mjpa receives the permission alone?

This module completely follows the coding standards, employs best practices, shows many examples of the module hook system, is integrated with rules, and provides significant simpletests. All the things I understood this application process is meant to test. I am disheartened by this.

sreynen’s picture

eosrei, sorry, I wasn't aware of that agreement. Your module may pass review, but no one has reviewed it yet. My closing of the issue was not intended as a review of your project. I simply assumed you no longer needed access to create full projects now that mjpa can promote your project.

If you still want to go through the review process, you're welcome to do that.

tim.plunkett’s picture

Status: Needs review » Fixed

I reviewed both the deprecated sandbox, as well as the resulting combined internal_nodes, and eosrei is certainly qualified to promote full projects (especially considering his graciousness in deprecating his own module). I'm granting him that ability, no need for him to go through another issue like this.

13rac1’s picture

Thanks a lot Tim! I really appreciate it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.