I have a site where students are keeping individual journals in the forms of blogs. I'd like them to be able to tag a post as being "private" which would cause it to be visible only to the "Teaching Team" group _and_ to the authoring student. Right now the first goal is being met. Unfortunately as soon as the post is tagged as "private", the original author loses the ability to see it. I imagine that making this work will require a code-level change doing the equivalent of "OR node.uid = current.uid" somewhere. Suggestions or patches would be most helpful. Thanks!

Comments

retsofaj’s picture

Category: feature » bug

I've hacked in support based on the example given on how the various authentication hooks work. The remaining problem is that when a user removes the security tag (leaving no tags) then the access control no longer works as node_access is essentially cleared. Since there are no term_access entries for the node, the access control fails until a permissions rebuild. How should I approach ensuring that TAC works when there are no tags defined for the node?

cpugeniusmv’s picture

Isn't there some sort of "Edit own <node-type>" permission in core you could use in conjunction with TAC? That should work.

xjm’s picture

Version: 6.x-1.0 » 6.x-1.x-dev
Category: bug » feature

I looked into this further; the issue is that core provides "Edit own" but not "view own." Generally, I've used other access control modules for this functionality.

Marked #125820: Allow Author Exceptions as duplicate of this issue.

xjm’s picture

Marked #187009: TAC and Projects as duplicate of this issue.

xjm’s picture

Component: Miscellaneous » Code

Marked #290730: Users can't view own content as duplicate of this issue. Code snippet in http://drupal.org/node/290730#comment-1028824 may be relevant.

xjm’s picture

See: http://drupal.org/project/view_own

Not sure how well it interacts with TAC at present; see #426434: Overrides/Conflicts with TAC Lite.