I want to use entityreference fields to refer to ECK entities.

If I grant 'view' access to these entities, then users can see the field value, but then they can also access the path for the entity. (Admittedly, they don't see a link because I can configure the field display not to show one. But they could still get to that path.)

If I don't grant 'view' access then they can't see the field value.

What's the correct way to handle this?

Comments

fmizzell’s picture

Very interesting.. ECK can not handle this scenario, but we need to have hooks available so you can develop more complex access rules. I don't remember if we have those hooks in place or not, but if we don't we need to add them, and if we do, we need to document them :)

joachim’s picture

Thinking about this some more, I wonder whether this is something that ought to be solved in Entityreference's field formatter rather than in ECK permissions.

Another place where this would happen is with reference fields to Commerce Products -- were it not for the fact that Commerce has its own reference field type. Commerce gets round this (I think!) because Product entities don't actually *have* a concept of 'view' that shows an entity display on a page. The link to a Product entity is always the entity form. I don't remember the exact details, as it's been a while since I worked with Commerce, but I *think* that because of this, the 'view product' permission just refers to viewing the title.

> but we need to have hooks available so you can develop more complex access rules.

Thing is, how would a hook implementation know that what's being shown is the title of the entity in a reference field formatter?

I can see two ways to solve this:

a. have an option in Entityref's formatter for 'always show title regardless of access'
b. have a concept for ECK entity types that don't have a page. This means the 'view' permissions degenerates to just allowing viewing of the title. That's not perfect, as even if you don't have a page for your entity, you might want to show a full render of it in a view.