By theview on

Hi - is there a way to have users edit their own nodes, but not anyone else's? This feature is called "administer nodes" in the user permissions page of user management. But I don't want the user to be able to edit anyone's nodes, just their own. Thanks!

Check out View Online!

Comments

arsart’s picture

arsart commented

they can edit them before posting, several times, like here - "preview comment" -a little time for thinking and correcting.
Or this is not enough for your users:))?

zealot’s picture

zealot commented

Thank you for the patch. Now collaborative books work the way I had hoped. Users submit documents to the moderation queue. Editors validate and publish the documents (vote + or -). Revisions to the documents are submitted to the moderation queue by new readers with additions, corrections, or deletions of text.

Request: make this part of the next release.

jonbob’s picture

jonbob commented

I've needed this for Drupal sites in the past. It takes only a couple small tweaks to node.module.

At the top of node_access, add:

global $user;
if ($op == "update" && $node->$uid == $user->$uid) {
  return 1;
}

And in node_link, after:

if (user_access("administer nodes")) {
  $links[] = l(t("administer"), "admin/node/edit/$node->nid",
    array("title" => t("Administer this node.")));
}

add:

if (node_access("update", $node)) {
  $links[] = l(t("edit"), "node/edit/$node->nid",
    array("title" => t("Edit this node.")));
}
Anonymous’s picture

(not verified) commented

I think this should make core.. I will make a patch for this and send it to the drupal-devel mailinglist..

jonbob’s picture

jonbob commented

The patch as I typed it above is fairly simplistic. Before patching HEAD, we need to look at a couple issues this introduces. First, a smart implementation will avoid multiple ways to get to the same place. It is already possible in some cases (book pages) to see an Edit and an Administer link that do nearly the same thing; this adds another Edit link in many cases. Also, there should probably be a separate permission for being able to revise posted content. I can definitely see a scenario when posted content would be viewed as inviolable, so that users can't get revisionist with their submissions after replies are posted.

I would like to see this get rolled in somehow. We just need to think it through.

theview’s picture

theview commented

Wow - thanks!! I inserted the code and now users can edit nodes w/o actually adminstering them. Only problem is - any user can edit any other user's node. I was hoping for a fix that would allow User A to edit only his nodes, and not be able to edit User B's nodes, too.

Check out View Online!

jonbob’s picture

jonbob commented

Well, that's what it's supposed to do. I'm surprised it's not working correctly for you. The $user->uid == $node->uid check is supposed to verify that the current user is the one that authored the node.

It looks like the node_link hook is working right for you, but something's wonky with node_access. What the top of that function look like?

theview’s picture

theview commented

the function says:

function node_access($op, $node=0) {

  global $user;
  if ($op == "update" && $user->$uid == $node->$uid) {
    return 1;
  }

  if (user_access("administer nodes")) {
     return 1;
  }

If you want to muck around my server...e-mail me at theview@rit.edu and let me know.

Check out View Online!

jonbob’s picture

jonbob commented

Ah, I see it now. the line should read:

  if ($op == "update" && $user->uid == $node->uid) {

Note the dollar signs.

theview’s picture

theview commented

Beautiful! Thanks for your help - much appreciated!

clauz’s picture

clauz commented

Within my node.module file the node_link function looks like this:

function node_link($type, $node = 0, $main = 0) {
  $links = array();

  if ($type == 'node') {
    if (array_key_exists('links', $node)) {
      $links = $node->links;
    }

    if ($main == 1 && $node->teaser && $node->readmore) {
      $links[] = l(t('read more'), "node/$node->nid", array('title' => t('Read the rest of this posting.'), 'class' => 'read-more'));
    }
  }
  return $links;
}

So...am I missing sth? I am using version 4.6.5.

Greetings!

PS: I have solved this in some other Drupal installation by creating a module for it, but now I wanted to check this one out.
Plus, I cannot install more modules cos I am getting the memory exhaustion problem...

Clauz
----------------------------------------
http://www.clauz.com.ar
I'm now in A Momentary Lapse of Reason

afagioli’s picture

afagioli
Location Rome
commented

In the 4.7 Drupal you can go like this:
(taken from http://www.fagioli.biz/?q=drupal-47-edit-node-just-owner)

Everything is inside the modules/node.module

Step A)

function node_menu($may_cache) :824

global $user;

Step B)

function node_menu($may_cache) :884

    if ( $node->uid != $user->uid and $user->uid !=1 )
          $items[] = array('path' => 'node/'. arg(1) .'/edit', 'title' => t('edit'),
        'callback' => 'node_page',
        'access' => node_access('update', $node),
        'weight' => 1,
        'type' => MENU_LOCAL_TASK);
    }

that means, put the edit creation tab inside the condition

Step C)

function node_form_array($node):1658

global $user;

Step D)

function node_form_array($node) :1736

if ( $node->uid != $user->uid and $user->uid !=1 )
{

watchdog('wrong_user', t('User tries editing not his own node', array('%category' => $form_values['category'])), WATCHDOG_NOTICE, l(t('view'), 'node/'.$node->nid));

drupal_set_message(t('you\'re not allowed to edit this node'));

unset ($form);


$form['#action'] = url('');
$form['node-form'] = array(
'#type' => 'submit',
'#value' => t('Back to navigation'),
);

}

This is brand new code to add to the module. Very easy:

If the user who's trying to go in edit node is not the owner nor the admin, just replace the edit form with a "dignostic message" and a "go to home page" submit button.

That's it!

I'm sure there's a better solution for that.

If you have some idea, please let me know

This is working on http://roma.cercachetrovi.it/