This seems vaguely related to #620392: Allow edit and delete access check in "Node Access: Access" filter, but I'm adding it as a separate patch since the code lives in a different handler. The basic idea is to add an option for the node access operation, so the argument validity check can check for access to view, edit, or delete operations rather than just the view operation.

Attached are patches for both 3.x and 2.x

I think it could use some work on the UI end, such as only exposing the operation radio buttons if the node access checkbox is selected first, but I'm not all that familiar with how to achieve that within the views form layer.

Comments

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

This looks fine. I didn't tested the patch

xjm’s picture

Tracking.

merlinofchaos’s picture

The one for Views 3 looks good.

I'm worried about the Views 2 one -- what happens if the patch is applied and an already existing view with this validator runs -- does it break because there is nowhere that the default 'view' is applied to the setting?

merlinofchaos’s picture

Status: Reviewed & tested by the community » Needs review
jhedstrom’s picture

That had occurred to me for views 2, so I was thinking to change the node_access code to something like this:

if (!node_access(isset($this->argument->options['validate_argument_node_access_op']) ? $this->argument->options['validate_argument_node_access_op'] : 'view', $node)) {
  return FALSE;
}

event though that makes for very ugly code...

merlinofchaos’s picture

I'd do that in multiple lines to make it more readable.

jhedstrom’s picture

StatusFileSize
new1.96 KB

Patch for 3.x is unchanged, but here's the updated 2.x patch that integrates the logic from #5.

bomarmonk’s picture

Testing.... thanks jhedstrom!

bomarmonk’s picture

So far, so good. I'm using the patch in #7 with views 2, and now I have a feature I've been wanting for my site for a good six years. Combined with bulk operations, it looks like I can now give each of my users their own customized workspace. I'm using taxonomy access and the view seems to correctly apply edit permissions as granted through the node access table. Awesome. I'll work with this some more and report back if I run into any issues. I applied this patch against Views 6.x-2.11. Thanks again for the great patch. I hope more people will test and review this so it can become a part of the official views release.

bomarmonk’s picture

StatusFileSize
new127.61 KB

Ah, not sure why it's not completely working, or maybe I'm not doing something right. I have the view argument set to user Id being able to "edit" the content. Unfortunately, it looks like some non-editable nodes get through the filter. Any ideas? Here is a screenshot and my view:

$view = new view;
$view->name = 'workspace';
$view->description = 'Per User View';
$view->tag = '';
$view->view_php = '';
$view->base_table = 'node';
$view->is_cacheable = FALSE;
$view->api_version = 2;
$view->disabled = FALSE; /* Edit this to true to make a default view disabled initially */
$handler = $view->new_display('default', 'Defaults', 'default');
$handler->override_option('fields', array(
  'type' => array(
    'label' => 'Type',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'strip_tags' => 0,
      'html' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'link_to_node' => 0,
    'exclude' => 0,
    'id' => 'type',
    'table' => 'node',
    'field' => 'type',
    'relationship' => 'none',
  ),
  'title' => array(
    'label' => 'Title',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'strip_tags' => 0,
      'html' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'link_to_node' => 1,
    'exclude' => 0,
    'id' => 'title',
    'table' => 'node',
    'field' => 'title',
    'relationship' => 'none',
  ),
  'name' => array(
    'label' => 'Owner',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'strip_tags' => 0,
      'html' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'link_to_user' => 0,
    'overwrite_anonymous' => 0,
    'anonymous_text' => '',
    'exclude' => 0,
    'id' => 'name',
    'table' => 'users',
    'field' => 'name',
    'relationship' => 'none',
  ),
  'status' => array(
    'label' => 'Published',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'strip_tags' => 0,
      'html' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'type' => 'yes-no',
    'not' => 0,
    'exclude' => 0,
    'id' => 'status',
    'table' => 'node',
    'field' => 'status',
    'relationship' => 'none',
  ),
  'changed' => array(
    'label' => 'Modified',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'strip_tags' => 0,
      'html' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'date_format' => 'small',
    'custom_date_format' => '',
    'exclude' => 0,
    'id' => 'changed',
    'table' => 'node',
    'field' => 'changed',
    'relationship' => 'none',
  ),
  'edit_node' => array(
    'label' => 'Edit',
    'alter' => array(
      'alter_text' => 0,
      'text' => '',
      'make_link' => 0,
      'path' => '',
      'link_class' => '',
      'alt' => '',
      'prefix' => '',
      'suffix' => '',
      'target' => '',
      'help' => '',
      'trim' => 0,
      'max_length' => '',
      'word_boundary' => 1,
      'ellipsis' => 1,
      'html' => 0,
      'strip_tags' => 0,
    ),
    'empty' => '',
    'hide_empty' => 0,
    'empty_zero' => 0,
    'text' => '',
    'exclude' => 0,
    'id' => 'edit_node',
    'table' => 'node',
    'field' => 'edit_node',
    'relationship' => 'none',
  ),
));
$handler->override_option('arguments', array(
  'uid' => array(
    'default_action' => 'default',
    'style_plugin' => 'default_summary',
    'style_options' => array(),
    'wildcard' => 'all',
    'wildcard_substitution' => 'All',
    'title' => '',
    'breadcrumb' => '',
    'default_argument_type' => 'current_user',
    'default_argument' => '',
    'validate_type' => 'none',
    'validate_fail' => 'not found',
    'break_phrase' => 0,
    'not' => 0,
    'id' => 'uid',
    'table' => 'users',
    'field' => 'uid',
    'validate_user_argument_type' => 'uid',
    'validate_user_roles' => array(
      '2' => 0,
      '4' => 0,
      '39' => 0,
      '10' => 0,
      '44' => 0,
      '14' => 0,
      '9' => 0,
      '6' => 0,
      '15' => 0,
      '11' => 0,
      '17' => 0,
      '46' => 0,
      '45' => 0,
      '7' => 0,
      '8' => 0,
      '42' => 0,
      '41' => 0,
    ),
    'relationship' => 'none',
    'default_options_div_prefix' => '',
    'default_argument_user' => 0,
    'default_argument_fixed' => '',
    'default_argument_php' => '',
    'validate_argument_node_type' => array(
      'casetracker_basic_project' => 0,
      'casetracker_basic_case' => 0,
      'mass_contact' => 0,
      'sitenotes' => 0,
      'weblinks' => 0,
      'panel' => 0,
      'bio' => 0,
      'book' => 0,
      'contact_information' => 0,
      'content_community_center_reserva' => 0,
      'content_county_file_or_form_cck' => 0,
      'content_file_index' => 0,
      'content_group_home_page' => 0,
      'content_minutes_or_agenda_cck' => 0,
      'content_road_report_cck' => 0,
      'county_facility_or_service' => 0,
      'custom_adm_script' => 0,
      'emerg_notice' => 0,
      'node_4web_edit' => 0,
      'page' => 0,
      'profile' => 0,
      'resuseable_location' => 0,
      'service_stub' => 0,
      'story' => 0,
      'webform' => 0,
    ),
    'validate_argument_node_access' => 0,
    'validate_argument_nid_type' => 'nid',
    'validate_argument_vocabulary' => array(
      '30' => 0,
      '3' => 0,
      '18' => 0,
      '9' => 0,
      '21' => 0,
      '24' => 0,
      '25' => 0,
      '4' => 0,
      '27' => 0,
    ),
    'validate_argument_type' => 'tid',
    'validate_argument_transform' => 0,
    'validate_user_restrict_roles' => 0,
    'validate_argument_php' => '',
    'validate_argument_node_access_op' => 'update',
  ),
));
$handler->override_option('filters', array(
  'type' => array(
    'operator' => 'in',
    'value' => array(
      'casetracker_basic_case' => 'casetracker_basic_case',
      'weblinks' => 'weblinks',
      'content_community_center_reserva' => 'content_community_center_reserva',
      'content_county_file_or_form_cck' => 'content_county_file_or_form_cck',
      'content_group_home_page' => 'content_group_home_page',
      'content_minutes_or_agenda_cck' => 'content_minutes_or_agenda_cck',
      'content_road_report_cck' => 'content_road_report_cck',
      'county_facility_or_service' => 'county_facility_or_service',
      'page' => 'page',
      'service_stub' => 'service_stub',
      'story' => 'story',
    ),
    'group' => '0',
    'exposed' => TRUE,
    'expose' => array(
      'use_operator' => 0,
      'operator' => 'type_op',
      'identifier' => 'type',
      'label' => 'Content Type',
      'optional' => 0,
      'single' => 1,
      'remember' => 0,
      'reduce' => 1,
    ),
    'id' => 'type',
    'table' => 'node',
    'field' => 'type',
    'relationship' => 'none',
  ),
  'type_1' => array(
    'operator' => 'in',
    'value' => array(
      'casetracker_basic_case' => 'casetracker_basic_case',
      'weblinks' => 'weblinks',
      'content_community_center_reserva' => 'content_community_center_reserva',
      'content_county_file_or_form_cck' => 'content_county_file_or_form_cck',
      'content_group_home_page' => 'content_group_home_page',
      'content_minutes_or_agenda_cck' => 'content_minutes_or_agenda_cck',
      'content_road_report_cck' => 'content_road_report_cck',
      'county_facility_or_service' => 'county_facility_or_service',
      'service_stub' => 'service_stub',
      'story' => 'story',
    ),
    'group' => '0',
    'exposed' => FALSE,
    'expose' => array(
      'operator' => FALSE,
      'label' => '',
    ),
    'id' => 'type_1',
    'table' => 'node',
    'field' => 'type',
    'relationship' => 'none',
  ),
));
$handler->override_option('access', array(
  'type' => 'none',
));
$handler->override_option('cache', array(
  'type' => 'none',
));
$handler->override_option('items_per_page', 100);
$handler->override_option('use_pager', '1');
$handler->override_option('style_plugin', 'bulk');
$handler->override_option('style_options', array(
  'grouping' => 'type',
  'override' => 1,
  'sticky' => 0,
  'order' => 'asc',
  'columns' => array(
    'type' => 'type',
    'title' => 'title',
    'name' => 'name',
    'status' => 'status',
    'changed' => 'changed',
  ),
  'info' => array(
    'type' => array(
      'sortable' => 0,
      'separator' => '',
    ),
    'title' => array(
      'sortable' => 0,
      'separator' => '',
    ),
    'name' => array(
      'sortable' => 0,
      'separator' => '',
    ),
    'status' => array(
      'sortable' => 0,
      'separator' => '',
    ),
    'changed' => array(
      'sortable' => 0,
      'separator' => '',
    ),
  ),
  'default' => '-1',
  'execution_type' => '1',
  'display_type' => '0',
  'hide_select_all' => 0,
  'skip_confirmation' => 0,
  'display_result' => 1,
  'merge_single_action' => 1,
  'selected_operations' => array(
    'views_bulk_operations_delete_node_action' => 'views_bulk_operations_delete_node_action',
    'node_unpublish_action' => 'node_unpublish_action',
    'node_assign_owner_action' => 0,
    'node_mass_update:a27b9efabcd054685a549378b174ad11' => 0,
    'system_message_action' => 0,
    'token_actions_message_action' => 0,
    'views_bulk_operations_ruleset_action_rules_set_1' => 0,
    'views_bulk_operations_action' => 0,
    'views_bulk_operations_script_action' => 0,
    'private_set_private_action' => 0,
    'private_set_public_action' => 0,
    'node_make_sticky_action' => 0,
    'node_make_unsticky_action' => 0,
    'node_mass_update:c4d3b28efb86fd703619a50b74d43794' => 0,
    'private_node_mark_private' => 0,
    'private_node_mark_public' => 0,
    'views_bulk_operations_fields_action' => 0,
    'views_bulk_operations_taxonomy_action' => 0,
    'views_bulk_operations_argument_selector_action' => 0,
    'node_promote_action' => 0,
    'node_mass_update:14de7d028b4bffdf2b4a266562ca18ac' => 0,
    'node_mass_update:9c585624b9b3af0b4687d5f97f35e047' => 0,
    'node_publish_action' => 0,
    'token_actions_goto_action' => 0,
    'system_goto_action' => 0,
    'node_unpromote_action' => 0,
    'node_mass_update:8ce21b08bb8e773d10018b484fe4815e' => 0,
    'node_save_action' => 0,
    'system_send_email_action' => 0,
    'token_actions_send_email_action' => 0,
    'node_mass_update:0ccad85c1ebe4c9ceada1aa64293b080' => 0,
    'node_unpublish_by_keyword_action' => 0,
    'auto_nodetitle_operations_update' => 0,
    'pathauto_node_update_alias_multiple:620e193b20ba9caa374fea9ca0ad38f0' => 0,
  ),
  'views_bulk_operations_fields_action' => array(
    'php_code' => 0,
    'display_fields' => array(
      'field_portrait' => 'field_portrait',
      'field_last_name' => 'field_last_name',
      'field_position' => 'field_position',
      'field_first_name' => 'field_first_name',
      'field_middle_name' => 'field_middle_name',
      'field_public_contact_phone_numb' => 'field_public_contact_phone_numb',
      'field_fax_contact' => 'field_fax_contact',
      'field_contact_location' => 'field_contact_location',
      'field_location_email' => 'field_location_email',
      'field_reservation_description' => 'field_reservation_description',
      'field_event_flyer' => 'field_event_flyer',
      'field_location_select_events' => 'field_location_select_events',
      'field_start_of_reservation' => 'field_start_of_reservation',
      'field_county_document_pdf' => 'field_county_document_pdf',
      'field_help_text_or_explanation_' => 'field_help_text_or_explanation_',
      'field_view_of_files' => 'field_view_of_files',
      'field_header_image' => 'field_header_image',
      'field_location_reference' => 'field_location_reference',
      'field_about' => 'field_about',
      'field_branch_name' => 'field_branch_name',
      'field_day' => 'field_day',
      'field_separator_days' => 'field_separator_days',
      'field_day2' => 'field_day2',
      'field_hours' => 'field_hours',
      'field_closing_hour' => 'field_closing_hour',
      'field_additional_text' => 'field_additional_text',
      'field_agenda_or_minute_file' => 'field_agenda_or_minute_file',
      'field_date_of_meeting' => 'field_date_of_meeting',
      'field_announcement_date' => 'field_announcement_date',
      'field_road_report_details' => 'field_road_report_details',
      'field_facility_image' => 'field_facility_image',
      'field_facility_contacts' => 'field_facility_contacts',
      'field_about_1' => 'field_about_1',
      'field_e_mail_1' => 'field_e_mail_1',
      'field_announcement' => 'field_announcement',
      'field_location_cck_reusable2' => 'field_location_cck_reusable2',
      'field_service_files' => 'field_service_files',
      'field_service_contact' => 'field_service_contact',
    ),
  ),
));
$handler = $view->new_display('page', 'Page', 'page_1');
$handler->override_option('path', 'content/%');
$handler->override_option('menu', array(
  'type' => 'none',
  'title' => '',
  'description' => '',
  'weight' => 0,
  'name' => 'navigation',
));
$handler->override_option('tab_options', array(
  'type' => 'none',
  'title' => '',
  'description' => '',
  'weight' => 0,
  'name' => 'navigation',
));
xjm’s picture

#10: I would suggest using the devel module to determine why the user cannot edit those nodes. (An input filter that user cannot use would be my first suspicion.) See: http://drupal.org/node/731850#devel

For anyone else trying to test this patch (I was confused at first): you want to add a user argument to the view. Supply a default argument of "currently logged in user" if you want it to show nodes editable by that user, then set the validator to edit.

Unfortunately, this patch seems to have the same issue that the Editor Views module does--it seems to only be aware of grants provided at admin/user/permissions, and not aware of the node access system. Nodes that a user can edit because of grants in the node access table do not appear in the view. Is this by design, a bug in the patch, or a mistake I made in setting up the view? (I can provide an export if needed, but it's a really simple node view with only this argument and no filters.)

merlinofchaos’s picture

xjm: That's a core Drupal design decision. Though Views 3 will now allow you to turn off the setting that does that.

merlinofchaos’s picture

Status: Needs review » Needs work

Seems like the D6 patch no longer applies.

I think at this point I will NOT be committing this patch to Views 2; I am trying to reduce the new features in Views 2 and this oen does not qualify as super important, so will be 3.x only.

So if I can get a 3.x reroll (preferably for D7 as well) I'll go ahead and commit it.

dawehner’s picture

http://drupal.org/files/issues/views.3.argument_access_op.patch

This is still the current version of the patch for 6.x-3.x

Here are patches for both branches

dawehner’s picture

Status: Needs work » Needs review

.

jhedstrom’s picture

The patch in #7 still applies cleanly to 2.x. However, I'm also fine with it not being added to 2.x.

xjm’s picture

I'm not sure how Views not understanding node_access grants is a core design issue... anyway. Does the 3.x version? The use case for this is creating lists of nodes that a certain user can edit. A feature that ignores the node access system (and therefore most access control modules) isn't too useful in that regard.

merlinofchaos’s picture

Status: Needs review » Fixed

xjm: I'm reading back through this trying to understand what we were talking about. This patch is allowing validation of the view based on whether or not the nid in the argument can be edited (or deleted) by the current user. It does not control listing nodes that the user can edit. That would be a filter, and this patch is not that. So this statement:

For anyone else trying to test this patch (I was confused at first): you want to add a user argument to the view. Supply a default argument of "currently logged in user" if you want it to show nodes editable by that user, then set the validator to edit.

...is simply incorrect.

Patch committed to 6.x-3.x and 7.x-3.x

bomarmonk’s picture

Ahhh... I'm not sure of the use case of this patch or of the distinction here. I am definitely looking to filter views to nodes the user can edit (as dictated through node access grants, including taxonomy access). Is what I want even doable? I've been hoping a solution to this would emerge for a long, long time: http://drupal.org/node/59924

I know: in that time I should have developed a new module myself :)

merlinofchaos’s picture

Bomarmonk: In theory yes, but the views_handler_filter_node_access filter needs to be modified similarly to this one. Right now it's hardcoded to test only view permission.

#620392: Allow edit and delete access check in "Node Access: Access" filter contains a patch that is set 'needs work'. Get that one going again.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.