By 2c on

Is it possible to give a user the access rights to edit their own post but not to delete it.

As an alternative to this, it would be nice if a user could delete their post ONLY if NO comment has been made on it.

⋅ Categories: Drupal 5.x

Comments

dokumori’s picture

dokumori commented

Since the right to delete is included in 'edit' privilege, you need to create a custom module to do that. Save the module below to your modules dir, accompanied by an appropriate .info file. Enabling this module will allow only the user #1 to delete nodes with comments. If you don't want users to delete their own nodes regardless of the number of comments, remove '&& $node->comment_count > 0' in line 5.

function custom_form_alter ($form_id, &$form){
  global $user;
  if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'edit'){
    $node = node_load(arg(1));
    if ($user->uid != 1 && $user->uid  == $node->uid && $node->comment_count > 0){
        unset($form['delete']);
    }
  }
}
2c’s picture

2c commented

Awesome, I'll try this out this evening.

grobemo’s picture

grobemo commented

Looks good, dokumori, but what if a Drupal-savvy user goes to /node/123/delete? Don't you need some code to block that?

I'm not sure what the best way to do it is. Maybe using drupal_goto to redirect them to a page that explains why they can't delete their node? You might include a link on that page to email an administrator if it's really important that the node be deleted.

cog.rusty’s picture

cog.rusty commented

I think the http://drupal.org/project/content_access module gives you separate "edit" and "delete" permissions per content type.

2c’s picture

2c commented

I've tried it out and it does indeed work.

To approach the problem of users typing in the url directly:

if (arg(0) == 'node' && is_numeric(arg(1)) && arg(2) == 'edit'){
    $node = node_load(arg(1));
    if ($user->uid != 1 && $user->uid  == $node->uid && $node->comment_count > 0){
        unset($form['delete']);
    }
  }
  if($form['actions']['submit']['#value'] == 'Delete' && $user->uid != 1 && $form['#parameters'][1]->comment_count > 0) {
  drupal_goto('ACCESS DENIED');
  }

Replace the 'ACCESS DENIED' in the code above with the URL of the page your users should get when they don't have permission to access a page.

dokumori’s picture

dokumori commented

yeah, i should have mentioned i wrote it in 5 min without much consideration :p
glad you spotted and fixed the problem.

aharown07’s picture

aharown07 commented

Does this code go into the module w/the first set? never tried to make a module before.
This is a great little solution though if I can get it working.

Edit to add: I don't see why the direct url prevention part is needed... if I keyin the url as "athenticated user" I get "access denied" error anyway. What does the above add?

aharown07’s picture

aharown07 commented

Well, this seemed to be working for a while, but now it isn't. Not sure what happened.
Made the module and .info file. Enabled.
But user who started the thread/topic can still delete it along w/his edit permission.

Ideas on why it isn't working?

francewhoa’s picture

francewhoa
he/him
Primary language French
Location Sept-Îles, Québec, 🇨🇦
commented

I upgraded my Drupal version 5 to version 6 and that gives me access to new 'Access controls'. This is located under Administer > User management > Permissions > node module.

In Drupal 6 'Access control' is call 'Permissions'.

New 'Permissions' such as:

  • delete any page content
  • delete any story content
  • delete own page content
  • delete own story content
  • delete revisions
Loving back your Drupal community result in multiple benefits for you  
francewhoa’s picture

francewhoa
he/him
Primary language French
Location Sept-Îles, Québec, 🇨🇦
commented

If you do not want to upgrade to Drupal 6 debtman7 did a module call Nodeaccess. It works with Drupal 4, 5 & 6:
http://drupal.org/project/nodeaccess

Loving back your Drupal community result in multiple benefits for you