By Ian Ward on

I wanted to make some flexinodes not viewable to certain user groups, but did not want to use an additional module like node access. Therefore, i modified flexinode.module, and added in the perm function:

$perms[] = 'view '. $ctype->name .' content';

Then I added in the access function:

 if ($op == 'view') {
  	return user_access('view '. flexinode_node_name($node) .' content');
  }

Then finally changed the menu hook user access calls like so:

 $items[] = array('path' => 'flexinode/list', 'title' => t('list view'),
      'callback' => 'flexinode_page_list', 'access' => user_access('view '. $ctype->name .' content'),
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/table', 'title' => t('tabular view'),
      'callback' => 'flexinode_page_table', 'access' => user_access('view '. $ctype->name .' content'),
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/search', 'title' => t('search'),
      'callback' => 'flexinode_page_search_form', 'access' => user_access('view '. $ctype->name .' content'),
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/feed', 'title' => t('rss feed'),
      'callback' => 'flexinode_feed', 'access' => user_access('view '. $ctype->name .' content'),
      'type' => MENU_CALLBACK);

where instead of user_access('access content')... it invokes the view permission.

Now, my question is, are there any security issues with this? Does it completely deny access to flexinode types for a user w/ a role that does not have view permission for the particular flexinode type?

Ian

Comments

mike stewart’s picture

mike stewart commented

Ian- this looks like some great work... Im still fairly new to drupal (about a month) - but 15+ years in IT... so Im diving in to drupal. HOWEVER, it would have been really nice if you had included some filenames & line numbers, etc. so that I could implement your mod... I'd give you feedback.

I think I have a similar problem... I need to prevent "view" (and in some cases "edit"/"post") capabilities for SOME content for certain users (such as anonymous, cust groups, etc.)

Michael Stewart
www.MediaDoneRight.com

Ian Ward’s picture

Ian Ward commented

Hey MdrMike,

I just made these modification to the existing flexinode module. Do a search for _perm to find the perm function, _access to find the access function, and _menu to find the menu hook. Then, each of the snippets I added closely resemble what is already there, so add them in to each function. For example, it does not matter if you add the 'view' perms before or after the 'edit own' perm...just add it in so it resembles what already exists. Write back w/ more if you need it...

Ian

ps. still no word back if this is totally secure...i think it is, but not sure yet. I know one hole is items will come up in searches...

sepeck’s picture

sepeck commented

You could always set it up as a patch file and submit it to the flexinode project. Some devs do not have time to go thruough the forums depending on their workload and so the experts in flexinode may not see it.

-sp
---------
Drupal Best Practices Guide - My stuff Black Mountain

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide

donnoit’s picture

donnoit commented

Ian,

I tried this out and it works nicely. I think I fixed the search problem too.

You may want to alter the flexinode_menu to make one single call to user_access('view '. $ctype->name .' content') for efficiency; so I altered your example to look so :

    $view_access = user_access('view '. $ctype->name .' content'); 
    $items[] = array('path' => 'flexinode/list', 'title' => t('list view'),
      'callback' => 'flexinode_page_list', 'access' => $view_access,
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/table', 'title' => t('tabular view'),
      'callback' => 'flexinode_page_table', 'access' => $view_access,
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/search', 'title' => t('search'),
      'callback' => 'flexinode_page_search_form', 'access' => $view_access,
      'type' => MENU_CALLBACK);
    $items[] = array('path' => 'flexinode/feed', 'title' => t('rss feed'),
      'callback' => 'flexinode_feed', 'access' => $view_access,
      'type' => MENU_CALLBACK);

The problem with search was already there, and nothing to do with the changes to flexinode. To fix that, I changed the node_search function in the node module by adding an if condition to conditionally execute the next 2 statements after the node_load call :

      foreach ($find as $item) {
        $node = node_load(array('nid' => $item));
        /* if condition added by me  */
        if( node_access('view', $node ) ) {
        $extra = node_invoke_nodeapi($node, 'search result');
        $results[] = array('link' => url('node/'. $item),
                           'type' => node_invoke($node, 'node_name'),
                           'title' => $node->title,
                           'user' => format_name($node),
                           'date' => $node->changed,
                           'extra' => $extra,
                           'snippet' => search_excerpt($keys, check_output($node->body, $node->format)));
        }                   
      }

This forces a validation by the right flexinode code to make sure the node can be accessed before including a result item. Should also work for non flexinode nodes.

JohnG-1’s picture

JohnG-1 commented

I'm having trouble with these patches.

Now no-one but admin can view flexinodes. (yes I config'd the perms!)

I've probably mis-applied the patches.

To cut a long story short, could someone possibly post/attach successfully patched versions of flexinode.module and node.module ?

thanks