Need help with node access for lists like Recent Blogs and Views lists

Posted by nvl.sateesh on December 4, 2012 at 5:18pm

I am trying to write a hook_node_access so that I can restrict users based on certain conditions to view only certain types of nodes. The code is as below:

function my_module_node_access($node, $op, $account) {
  $type = is_string($node) ? $node : $node->type;
  // lets get the current country selection from URL
  // we will go further with node access only if country param is set
  $country = $_GET['cn'];
  
  if (isset($node->nid) && $op == 'view' && $type != 'panel') {
    if (in_array($country, my_module_allowed_countries())) {
      return NODE_ACCESS_DENY;
    }
  }

  // Returning nothing from this function would have the same effect.
  return NODE_ACCESS_IGNORE;
}

The above works fine and actually denies access to all content types except panels. However, in lists like Recent Blogs, or in Views, it still shows all content ignoring this access condition.

I read online that I have to use addTag('node_access') to make the permissions apply on lists. However, I am not sure where I should do this exactly and how. I tried the following without success:

function my_module_query_alter(QueryAlterableInterface $query) {
  $query->addTag('node_access');
}

Any help is greatly appreciated. Thanks and have a great day!

Comments

any one please ?

Posted by nvl.sateesh on December 6, 2012 at 7:15pm

any one please ?

NVL Sateesh
Drupal Geek at Newtarget, Inc.

you can only add tags to queries that are already tagged

Posted by justageek on December 8, 2012 at 3:59am

http://api.drupal.org/api/drupal/modules%21system%21system.api.php/funct...

if you do not need to protect too manu URL values, you can use something like hook_init() to check the url and see if the user has access to the page. This is not very portable, i.e. every time you create a new page you have to determine how to protect it.

@justageek thanks. using url

Posted by nvl.sateesh on December 9, 2012 at 6:47pm

@justageek

thanks. using url pattern match is not needed. If i need to stop access for the full node view, i can easily use hook_node_access(). I want to access the nodes when they are getting displayed in dynamic lists like "Recent Blog Posts" or Views lists, etc.

Thanks :-)

NVL Sateesh
Drupal Geek at Newtarget, Inc.