Not sure if this has been addressed earlier, I've searched but came up empty.

Scenario:

Domain Access site with many domains, having many different domain editors. These editors needs to be able to search and edit users to handle incoming support requests, adding editors, assigning roles etc. Now, if an editor has permission to edit users, they can edit users for all domains. We need to restrict this so that an editor only has access to edit users that are assigned to the same domain as themselves.

I'm guessing it would include some pretty ugly checks in hook_user, but I wonder if that would be enough to completely fix this. Ideas? New module or patch to existing?

CommentFileSizeAuthor
#3 domain_user_restrict.zip1013 bytesblackdog

Comments

blackdog’s picture

blackdog commented
Title: Restrict access to users profiles per domain » Restrict access to edit users profiles per domain

More accurate title.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

New module.

Try using hook_menu_alter() to assert your own access callback for the path 'user/%user/edit'.

In that callback, check the domain information against the user data and permissions.

http://api.drupal.org/api/function/hook_menu_alter

blackdog’s picture

blackdog commented
Status: Active » Needs review
StatusFileSize
new domain_user_restrict.zip1013 bytes

Hey Ken,

I've attached the new module domain_user_restrict, if you'd like to review.

Should I start a new project for this, or could it be included in the domain module?

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

New project. We are already maintaining too much code.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Needs review » Closed (won't fix)

Some quick review:

-- I would change the name of the module. Domain User Restrict doesn't really suggest what it does. 'Domain User Edit' maybe?

-- You may have to run domain_get_user_domains($account) and domain_get_user_domains($user) before you check $account and $user, as the loading of the $user object is notoriously inconsistent.

blackdog’s picture

blackdog commented

Thanks Ken,

I'm gonna take a look at this tonight.

blackdog’s picture

blackdog commented

New module is up: http://drupal.org/project/domain_user_edit
First dev release should be up soon.

enrikito’s picture

enrikito commented

D7 port?