uid argument validation: check if uid = current user

For consistancy, the argument should probably be "Current user or admin", and also give access if the user has "Administrate users" or similar permission.

This is not a documentation issue. Just tidying up.

This may be a User data issue. Noted on Obtaining support for Views issues http://drupal.org/node/571990

subscribe

This can be accomplish by adding a "User: Current" filter to the views.

Feel free to change it back to active if I am wrong.

This patch add an "Only allow current user or admin" checkbox to the user validator.

I ran some test and nothing seem to had broken with the patch.

I'm no views expert so someone could probably implement it better.

All comments welcome.

needs review is more likely to get attention =)

+++ modules/user/views_plugin_argument_validate_user.inc	25 Apr 2010 22:49:20 -0000
@@ -99,6 +106,15 @@ class views_plugin_argument_validate_use
+      if(!user_access('administer users', $GLOBALS['user'])){

we don't have to use globals here.

Powered by Dreditor.

Here's an updated patch not using Globals.
Thanks for that.

Hi,

Just grammar-wise:

+    //Check if only the current user or admin is allow

should be

+    //Check if only the current user or admin is allowed

so

Subscribe

should be

+    // Check if only the current user or admin is allowed.

:)

+    if (!empty($this->options['restrict_user'])) {
+      if (!user_access('administer users', $account)) {
+        if ($argument != $account->name && $argument != $account->uid) {
+          return FALSE;
+        }
+      }
+    }
+

We could save here also at last one or two if's

subscribing

Related #404768: Filter which compare user selected from filter with current logged user

subscribe

lol, so I actually don't like this patch. Do we really want to hard code the settings to the 'administer users' permission. Wouldn't we want to make it a little more flexible than that?

I agree with @ericduran, 'administer users' is really a harmful perm. This patch allow to configure which permission is necessary if argument is not the current user.

Role checking is a lot easier than permission checking, so I'd rather not go that route.

Also, this patch would simplify this a lot: http://drupal.org/node/644008 -- the use of actual permissions rather than validation.

This is quite an old thread, but I have exactly the same issue as the OP.

I can't see that this patch has been applied and I can't find a suitable solution via Views alone, so I thought I'd post something here in case there is an alternative solution these days and I've missed something.

Basically, Views view Access based on whether the user argument passed in is the current user (or the current user is admin). I don't want any old user able to view other user's Bookmarks.