By DaSilvaIreland on

Hey, I have a custom content-type that has a field in it called 'permitted'. I want to restrict the content of this view to only the creator, and a user with a user uid matching the number stored in the 'permitted' field.

Letting the creator see it is fine. Trying to allow only the 'permitted' user is where I have the problem.

Using a content filter on the 'permitted' field, allows me to only either choose a static number like '1' or '20' etc.. or to use arguments like %1. Arguments could work I could inject the current users uid into the url, but that would make it really easy for anyone who paid attention to simply put someone else's uid in the url bar and see things they should be allowed too.

Is there another option?

⋅ Categories: Drupal 6.x

Comments

DaSilvaIreland’s picture

DaSilvaIreland commented

Well, I have been looking and looking and still no luck. I also tried adding a filter "permitted == 999", exporting the view, opening up the code, and replacing the '999' with $node->nid and finally reimporting it. However after reimporting it, Views replaced my "$node->nid" with "NULL" :\

ytin’s picture

ytin commented

See if the Node Access User Reference CCK field is what you need. http://drupal.org/project/nodeaccess_userreference .

DaSilvaIreland’s picture

DaSilvaIreland commented

Much appreciate the reply, although it isn't exactly what I need. I can't talk about what I am actually making so I will use a different example to explain what I'm trying to do.

There are 2 types of Users (or roles). 1 type of user lets call them 'Contributors' create content (nodes) called 'Books'. The Contributors can only view their own creations. The other type of user lets call them 'Readers' buy 'Books' and then get access to view the purchased 'Book'. With the above module it gives Contributors the ability to grant access to Readers to view the Book, but it would be easier if this interaction wasn't necessary and instead if the Reader just bought the book and automatically got access granted.

DaSilvaIreland’s picture

DaSilvaIreland commented

Well I finally found a way.

The module http://drupal.org/project/viewsphpfilter lets you add filters that can have embedded php. It's pretty tricky to use since you cant get any indicators of what's going wrong when your filter doesn't work. Nevertheless it works and I got my problem sorted.

gnassar’s picture

gnassar commented

Glad it worked out for you.

Yes, there's little user-interface reporting on PHP errors. That's an open point for development, though it was low priority due to my opinion that most people wanting to/competent enough to throw raw PHP into a filter would also be OK just using the PHP error_log() function to fix any errors. But hopefully a bit more reporting will be in the module in the future.

soopah256’s picture

soopah256 commented

Hi DaSilva,

I'm trying to do something similar with my own view's filter. Basically I have an admin user create "product" nodes. Each "product" node has a drop down menu field of customer users that the "product" is assigned to (each product only has one customer associated with it).

I'd like to set up a view for each customer so they can see what "products" have been assigned to them.
So basically I want a filter that can check whether the product node's customer field matches their user id.

hellomobe’s picture

hellomobe commented

Can you share the PHP code you use to for the argument. Thanks

jgoodwill01’s picture

jgoodwill01 commented

Can you share what code you used to check this? I've tried using Views PHP Filter with little success.

DaSilvaIreland’s picture

DaSilvaIreland commented

Sorry I never provided an example of how I achieved this, but I will now, I know it's a long time since most people have asked however I haven't been using Drupal for almost a year so I never noticed people asking.

Here's an example of what I did anyway..

global $user;

//get nodes where the "permitted" field is the current user ID
$resultSet = db_query('SELECT nid FROM my_table WHERE permitted = %d', $user->uid);

$nodesToDisplay = array();
while ($row = db_fetch_array($resultSet)) {
    $nodesToDisplay[] = $row['nid'];
}

//This is required to prevent what is probably a bug.
//When the above query returns no rows (the user is not the author) of any nodes
//Then for some reason the ViewsPHPFilter wont filter anything and that user will see every node.
//I am not 100% sure if -1 is safe, could -1 ever be a valid node id? Probably not, unless some unsigned business goes on underneath the hood.
if (empty($nodesToDisplay)) {
    return Array(0 => -1);
}

return $nodesToDisplay;

Note, you do not add the php opening and closing tags.