By ilo on

I looked out and didn't find any clue to this question: What is the correct way (if possible) from my own module to validate the deletion of nodes of my own type?

Examples:
- to delete a poll, the poll should not be active first.
- to delete a group, no users but the owner should be in list.

The node module performs the hook_delete, but no return value is handled by the node module. Also hook_validate is only checked at creation time. I didn't know about any module that has this 'feature'/'requeriment' before deleting their node types so I have no example to talk about.

The closest tag I've seen is the og module that 'form_alter's the node edit form, and presents a new 'how to delete' form, but doesn't validate the deletion. Another workaround is to modify the menu entry 'node/id/delete' when the node type is the own defined, but it's not a light idea..

So.. what to do?

Suggestions are welcomed!

⋅ Categories: Drupal 5.x

Comments

thesaint_02’s picture

thesaint_02 commented

Yes, hook_form_alter looks like the right place to do that.
Just check if the form_id is "node_delete_confirm". In the "#parameters" value of $form you have the node that is to be deleted - youc an check the type and other properties and change the form elements accordingly. If you want to see what's available in the $form array when hook_form_alter is called, just add the following line to the function:

$form['info'] = array('#value' => "<pre>".htmlspecialchars(var_export($form, true))."</pre>");

Don't know if this will prevent malicious users with some drupal knowledge from sending the values of the "original form" with a command line client like wget or curl. Will drupal use the altered form values to check if the confirmation was sent? Then you could insert the following line to prevent deletion of certain node types:

unset($form['confirm']);

ilo’s picture

ilo commented

I did check about tampering the form from client side (greasemoneky script with form editing features) and the key seems to be set confirm to 1 wen user is really granted to freely delete the node. The node is not deleted untill the form_alter function returns with $form['confirm']['#value'] to 1, even if the client sends it's value to 1 there's a chance to set to 0 again.

So, as you said before:

function your_module_form_alter($form_id, &$form) {
   ..
// We reach this piece of code from edit to delete node and delete confirmation.
   if ($form_id == "node_delete_confirm" ){ 
// perform own checks on the node..
      if ($not_to_be_deleted){
         $form['confirm']['#value']=0; // or unset($form['confirm']);
         drupal_set_message('you need to XXXx before deleting this post','status');
         return;
      }
  }
}

Thanks a lot for the advance in forms, very helpful information.