Not checking for user_access() before displaying link

Hi George2,

Thank you very much for your modification code.

My situation of user-access check is little bit different from your offer, I want that the only person who created the parent node could see the link of creating the child node (node has node reference filed).

I am just an end-user. I dont know much about PHP coding. Could you please help the code to check user-access as above before showing the link.

Thanks in advance.

Nguyen Quoc Viet

I think a patch would be most helpful here.

Thanks heyrocker and George2. Committed.

Hi,

This seems to be working backwards? The link is displaying only when the user has permission to create nodes of the same type as the node that has the link, instead of the type the link points to. I have Type1 and Type2. The link is on Type1, and points to node/add/type2. The link only appears if the user has permission to create Type1.

if ($field['referenceable_types'][$object->type] && user_access('create ' . $object->type . ' content')) {

I replaced $object->type with $target_type and it seems to work fine.

if ($field['referenceable_types'][$object->type] && user_access('create ' . $target_type . ' content')) {

Thanks davidhernandez, I think you're right. Committed this fix as you recommend.

Hi,

Thank davidhernandez for a new way of user access checking before showing the link.

Could someone help the code for my own user access checking as follow ?

I want only the parent node's author and those who has "Edit Any ..." permission on that parent node type could see the links.

Currently, I solved my issue not in module coding but in template file as following:
- I create template file with name node-parentcontenttype.tpl.php
- For showing the link with above user-access checking I add the code below into the template file:

global $user;
if (user_access('edit any parentnodetype content') ||
(user_access('edit own parentnodetype content') && ($user->uid == $node->uid))) {
print l($node->links['childnodetype_field_nodereference_field']['title'], $node->links['childnodetype_field_nodereference_field']['href']);

}

Note:
- The above code is working fine to me.
- Two variables $node->links['childnodetype_field_nodereference_field']['title'] and $node->links['childnodetype_field_nodereference_field']['href'] come from contemplate module.
- Function l() is used to recreate the link to child node.

Because I dont know how to call/access $node->uid of parent node from node reference url module code that is why I could not write code directly in the module.

Besides, George2's, davidhernandez's and my own way of user-access checking are different ways of module usages. Could quicksketch add an option on new UI configuartion that allows user to select which way they want to show the link on the parent node.

Thank you and regards
Nguyen Quoc Viet

nguyenquocviet, it sounds like you've got 2 requests in your post. However, neither of them apply to the topic of this thread "Not checking for user_access() before displaying link", which is a bug report. You've posted a support request and a feature request. Please open two new issues, titling and categorizing each one appropriately.

EDIT: The below comment was written in the believe that the patch from #8 was already in 6.x-1.1 - I have checked this now and it is not. So with the patch in #8 it works fine for me (I have just tested it).

Hello.

Thanks for this great module.

I have downloaded 6.x-1.1 . I have the same issue as in comment #7 so somehow #8 did not solve it ( I assume that the patch was included in 6.x-1.1 ?).

The problem is:
I created two node types. Type1 should only be created by admin, type2 by any authenticated. This works so far but the link for creation of type2 is not shown for authenticated user without the permission to create type1.
It is pnly the link. Authenticated can go directly to the node/add/type2/ref , but only admin sees the link. This changes when you give authenticated create type1 rights. He can then see the link. But he should not be allowed to create type1.
As I understand this is exactly the problem of #7.

Thanks in advance for your work.

JThan

The patch was not included in the 1.1 version. So you need to apply the patch, use the development version, or wait for the 1.2 version to come out.