In the "Content editing forms" setting you can chose for: "Take user to their assigned domain". I use this setting.
In one of my DA-sites whith several subdomains I have a user which only can create content in one subdomain only. Whenever he/she creates content everything goes as expected: the content is in the assigned domain (according to my first line).
But when this user tries to edit or delete a node in another (sub-)domain this is allowed, even the node keeps it domain after submitting the change.
How can I block a user from editing content from a domain he/she is not allowed to create content in?
I searched all open issues, but couldn't find such a question, nor the documentation mentions it.

Comments

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

If the user owns the node, you can't.

You would have to remove any 'edit all X' content type permissions from the role and only use 'edit domain nodes.'

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Active » Closed (works as designed)
promes’s picture

promes
Primary language Dutch
commented

Thanks for your quick reply and my delay. I am very busy at the moment.
I still have a problem. I think I don't understand it completely or the way I like it to work is different from your implementation.
If I do what you recomment, the user is able to edit current nodes in his domain only, but is not allowed to create any node.
What I want:
user 5: can only create, edit all and edit own story in domain 2, but not in other domains
user 6: can create, edit all and edit own all nodetypes in domain 2, but not in other domains
user 7: can only create, edit all and edit own books in domain 2, but not in other domains
user 8: can only create, edit all and edit own books in domain 2 and 3, but not in other domains
user 9: can only create, edit all and edit own books in domain 3, but not in other domains
user 10: can create, edit all and edit own all nodetypes in domain 1 and 2, but not in other domains

Is this possible?

promes’s picture

promes
Primary language Dutch
commented

I found a solution for my problem. I created a small module with the following content:

<?php
function mydomain_node_nodeapi(&$node, $op, $a3 = NULL, $a4 = NULL) {
  switch ($op) {
    case 'prepare':
    global $user, $_domain;

    if (!$user->domain_user[$_domain['domain_id'] == 0 ? -1 : $_domain['domain_id']]) {
      drupal_access_denied();
    }
  }
}

drupal_access_denied() in this context is not user friendly: it clutters the result with an additional screenlayout. I modified this function in two places to send a correct result page to the user. I you anyone is interested, send me an e-mail.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

Node access modules have no say in the 'create' operation.