I have a need to allow users to edit some editablefields, but I don't want to provide them full Node Update access / permission.

This problem is also described in for D6-version in:
#1021778: Editing fields without update access (D6) , which adds a new permission in the module itself, and
#488816: Requires "Edit Any" Permission, which also includes some comments on $node->status.
Since the D7-code/solution is much shorter, I created this separate issue.

The following patch allows editablefields in e.g. Views with EITHER Node_update_access OR field_edit_access:

   // See if access to this form element is restricted,
   // if so, skip widget processing and just set the value.
-  if (!entity_access('update', $entity_type, $entity) || !field_access('edit', $field, $entity_type, $entity)) {
+  if (!entity_access('update', $entity_type, $entity) && !field_access('edit', $field, $entity_type, $entity)) {
     // Can't edit.
     return editablefields_fallback_formatter($entity_type, $entity, $field, $instance, $langcode, $items, $display);

Then, in custom code, I implemented hook_field_access().

/**
 * Implements hook_permission().
 */
function my_module_permission() {
  return array(
    'edit editable fields' => array(
      'title' => t('edit editable fields while viewing content'),
    ),
  );
}

function my_module_field_access($op, $field, $entity_type, $entity, $account) {
 if( $op == 'edit' && $field['field_name'] == 'field_my_field' ) {
      $access = user_access('edit editable fields', $account);
      return $access;
  }
}
CommentFileSizeAuthor
#11 editablefields-1344634-11.patch1.24 KBMouna Hammami
#10 editablefields-1344634-10.patch1005 byteslchang
#6 editablefields_1344634_5_field_permission.patch1.02 KBemattias
#4 editablefields_1344634_4_field_permission.patch815 bytesemattias
#1 editablefields_1344634_1_field_permission.patch735 bytesjohnv

Comments

johnv’s picture

johnv
Primary language Dutch
commented
StatusFileSize
new editablefields_1344634_1_field_permission.patch735 bytes

Here is a proper patch.

Taxoman’s picture

Taxoman commented
Priority: Normal » Major

Marked #1391906: Edit own content permission not applied? as a duplicate of this issue, since the patch is here.

skylord’s picture

skylord commented
Status: Needs review » Reviewed & tested by the community

+1 for this patch.
BTW, "field_access" returns TRUE be default, so it will work OK without custom hook_field_access() implementation. Also keep in mind https://drupal.org/project/field_permissions and other field access modules - custom code is generally not needed at all.

emattias’s picture

emattias commented
StatusFileSize
new editablefields_1344634_4_field_permission.patch815 bytes

Here's the patch in #1, made to work with the current HEAD.

emattias’s picture

emattias commented
Status: Reviewed & tested by the community » Needs review
emattias’s picture

emattias commented
StatusFileSize
new editablefields_1344634_5_field_permission.patch1.02 KB

Here's an update to the #4 patch. This new patch makes it so that if you have entity_access but not field_access you get the fallback. The #4 patch didn't show that fallback in that case.

FrancoNogarin’s picture

FrancoNogarin commented

+1 for this patch :D

bsarchive’s picture

bsarchive commented

!! This patch risks allowing users to edit all editable fields.

Because hook_field_access returns TRUE by default, if you put this patch in, all users will be able to edit all fields unless you've denied them access to those fields through hook_field_access or some other means.

Leeteq’s picture

Leeteq commented
Status: Needs review » Needs work
lchang’s picture

lchang commented
StatusFileSize
new editablefields-1344634-10.patch1005 bytes

Maybe we can use the Field Permissions module.

Mouna Hammami’s picture

Mouna Hammami commented
StatusFileSize
new editablefields-1344634-11.patch1.24 KB

Hello,
#10 works fine.
this is a similar patch for 7.x-1.0-alpha2+14-dev version

bisonbleu’s picture

bisonbleu commented
Status: Needs work » Needs review

Thanks @Mouna Hammami, patch in #11 works for me

osopolar’s picture

osopolar
Primary language German
Location 🇩🇪 GER 🌐
commented
Status: Needs review » Needs work

The patch works fine, but in my opinion it should not introduce a new dependency, as this would not be compatibility with existing installations.

Instead there should be a check if the field-permission module is enabled or not. If not, entity_access() should be used. If it is present, then there should be an option (for each entity bundle) to choose which type of access check should be used (field_access or entity_access), entity_access should be default to not change current behavior by just enabling the module.