If access to a field is denied to a user for any particular reason (Eg. CCK Field Permissions module), this module should not count that field towards the required fields. I am running into a situation where all fields in a node are needed for completeness, but not all users are allowed to access all the fields.

There is two ways I can see to accomplish this.

1. Invoke the node form, and check the #access property of each item.
2. Declare a new hook so that other modules can be passed a node that they then can check over, and pass back an array of disallowed (or allowed) fields.

I'd be willing to code up a patch using either of these methods, but I thought I would check to see which method you prefer.

Cheers,

Patrick

Comments

pvhee’s picture

pvhee commented

Great! If #access is the default drupal way to handle access permissions for fields I would use that one.

hlopes’s picture

hlopes commented

+1

hlopes’s picture

hlopes commented

I've patched the module to do so.

This applies to content_complete-6.x-1.2.

File: content_complete.module
Line: 262

function content_complete_get_data(&$node) {  
  $fields = content_complete_get_fields($node->type); // Grab all fields for that content type
  $tagged_fields = variable_get('content_complete_fields_'. $node->type, array()); // Fields tagged for completeness (can be empty)

+  foreach($tagged_fields as $k => $v){
+    if(!user_access("edit ".$v))
+      unset($tagged_fields[$k]);	  
+  }

+  $tagged_fields = array_values($tagged_fields);

And that's it. Just ensure that the permissions strings are in english in your user permissions page.

For instance, for a cck field named district, ensure that the permission string starts with edit, or change the "edit " in the following line to whatever you see there.

Like, i'm portuguese, so the permission reads "editar field_district".

Hence, my code is

+ if(!user_access("editar ".$v))

phayes’s picture

phayes commented

This code above will only work if people are using content_permissions module, it is not a general solution. Checking #access on the form is a better general solution. But the above would certainly work for those who only need to filter according to content_permissions

pvhee’s picture

pvhee commented

#3: please create a drupal patch for this. For more info how to do this check out http://drupal.org/patch/create

If a general solution is possible, we should go for that one.

hlopes’s picture

hlopes commented

Oh yes, forgot about that.

Totally true, this is a patch for people who are using content_permissions module.

Is #access defined for the field itself? Or do i have to get the form, check #access for all elements, and then return an array of allowed fields ids?

phayes’s picture

phayes commented

@HLopes,

I'm not sure if CCK explicitly sets permissions for each field. I suspect that it is just writing to #access for each form field. I think that we may have to do the "get the form, check #access for all elements, and then return an array of allowed fields ids" but i'm not 100% certain.

hlopes’s picture

hlopes commented

Well, actually this piece of code works for all permission restriction modules, as long as the module works using permissions, and the created permission string for field respects the usual format, something like:

edit $field_fieldname

For what i've seen, both content_permissions and field_permissions do so.

I was kinda in a wild-goose chase, looking for #access everywhere... Just to remember that drupal has no access control on a clean install + cck.

I wonder, would this work with translations?

if(!user_access(t("edit")." ".$v))

Added an if to check if any of the permission modules is installed. (I only know these two, so if you know any other, just add a comment below)

if(module_exists("content_permissions") || module_exists("field_permissions"))
  {
    foreach($tagged_fields as $k => $v){
      if(!user_access("edit ".$v))
        unset($tagged_fields[$k]);	  
    }
  }

  $tagged_fields = array_values($tagged_fields); // Re-index array
pvhee’s picture

pvhee commented

The above code will only work if completeness is computed on the fly. Right now, computeness is cached the first time the completeness is requested, which will be different depending of which user is logged in. We would therefore need a more general solution that caches either per user, or finds out whether it can use the cached completeness or not. Looking forward to hearing your ideas on this topic.

hlopes’s picture

hlopes commented

Just activated the cache to try it out how it goes under production like environment. Will report soon.

pvhee’s picture

pvhee commented

Any news on this?