I've recently been using nodeapi in my PayPal module to restrict access to parts of an advert before it is paid for. This was ideal for me as nodeapi can effect any kind of node type I was able to allow admins to choose which types should be paid for, including CCK created types.
This led me to wonder: Would it be possible to extend nodeapi to allow it to secure a site? Not just modify the node at various key stages as it currently does but allow it to completely prevent access to a node.
I dont believe you can do this at present, but I am willing to be proved wrong. I think you would need some sort of hook into node loading to complete things.
I was looking through some of the internals of the node.module and its possible but probably a lot of work.
The advantage would be a site wide way to implement a new security system across all kinds of nodes.
I was wondering if anyone had any comments on this idea?
Lee
Comments
Example
http://api.drupal.org/api/4.7/file/developer/examples/node_access_exampl...
node_access_example
Thanks. I'd already read this but the access control in it only applies to its own node type.
Lee
--
Lee McLoughlin
lmmrtech.com
Compare other access modules
Access control in general is not dependent on node type. If you want to build a new access module, that's the way to go.
node access control
In general access control may be node type. But there are cases where that is not suitable. Suppose you had a pay site where you wanted to restrict all kinds of content from non-paying users. Currently the only way to do this is with one of the access control extensions such as TAC. The access control extensions are complex for both the programmer and user. By extending nodeapi to allow we could have a much simpler system.
--
Lee McLoughlin
lmmrtech.com
Nodetype
I don't know any module that uses nodetype to restrict access. workflow_access restricts access based on workflow state; simpleaccess based on a per node base, but not related to the contenttype; taxonomy access based on the terms; og based on group access. Of course one could write a module that restricts view/edit based on node-type, but I don't know any yet - there may be one, though.
The module access is based on a module/role base. You could provide a view grant in a module and some do, but as far as I know most don't and so the general node view access grant applies. Please correct me if I am wrong.
Restricting by node type
My own module lm_paypal provides restrictions on a per-node type basis as does Premium.
Lee
--
Lee McLoughlin
lmmrtech.com
Solved?
I don't understand your question. We both seem to agree that one can completely block access to a node with the help of a module. You already did it. Other modules do it. So why did you ask if it is possible?
My module, and Premium, can
My module, and Premium, can mask the contents of a node but not make it vanish. I can replace the title, body and teaser - but something still has to be there.
If nodeapi was extended so there was a way to block node loading then it could act like the existing access control except across all node types.
Lee
--
Lee McLoughlin
lmmrtech.com
Just wanted to agree with
Just wanted to agree with you.
Node access control is very complex. Sure there are a handful of folks out there screaming, what are you talking about, it's easy!. But it's simply too easy to hide all of your content from users by breaking the node_access table. And it's too difficult to restrict access reliabley. All of the access related modules are notoriously problematic. The fact that someone wrote na_arbitrator is further evidence that the scheme is not right.
A task like creating a private forum should be simple. But it's extremely difficult. TAC_Lite promises a fairly simple means of restricting node access, but it's buggy and doesn't work in some scenarios.
It seems to me that a unix-like permission system would be perfect for Drupal. read/write/execute permissions. read/write for nodes (unix files) and create permissions (execute) by owner (author) group (role) and world (anonymous).
--
Drupal tips, tricks and services
http://devbee.com/ - Effective Drupal
--
Devbee - http://devbee.net/
Just submitted a patch to add nodeapi('access') to node.module
I have a similar requirement and I created a patch to add it to node.module. See http://drupal.org/node/91709
Of course no garantee it will make it in. But I couldn't find another way of doing it.
-Mike