Search code examples
phpdrupaldrupal-6moduleaccess-control

Drupal section accessible by role

I need to limit access of content on Drupal site based on the Drupal User's Role.

http://site.com/managers/intro

http://site.com/managers/reviews

http://site.com/managers/up-for-raises

The content can be of multiple content types and isn't limited to one specific content-type. These content types will be used elsewhere on the site so I can't lock down the whole content type.

I can get all the nodes/views to live at those addresses by menu settings when they are created, but I don't know how do I limit access via role other than a bunch of preprocess functions in template.php, but that seems to be the wrong way to do it.

I searched for a module and asked on #drupal-support IRC, but no results came up that use drupal roles as the limiting factor.

Solution

  • If i got it right, what you are trying to achieve is to have only certain roles being able to access pages located at a given URL.

    BY USING A CONTRIB ACCESS MODULE

    As already mentioned by mcrittenden, there is a plethora of modules that allows you to tweak content access. Among them, content access can surely do what you want to, as it allows you to set up permission for each node separately.

    BY USING FLAG + VIEWS

    Another possible way to do this without coding, is with a combination of the flag module the views module. Here's a brief overview of how I would do:

    1. Create three flags, which you can use to mark content (any type of content!) that will have to be viewed at any of the addresses you specified in your question (for example: create a flag "intro" that you will use to mark nodes that have to be displayed at the page "/mangers/intro")
    2. Create 3 views (one for each address you listed in your question) that would pull out of the DB the nodes you need by filtering them on the basis of your flag.
    3. Set the permission of these views according to the role.

    BY WRITING A MODULE THAT CHECKS THE URI AND BLOCK UNAUTHORIZED USERS

    You surely can do this. The main advantage would be that it would be a very lightweight solution in terms of CPU and memory load, but there are a few gotchas you have to pay attention to. For example the fact that you can always access your content via urls in the format the http://example.com/node/nodenumber), so you have to check a URL for its aliases too. But also the fact that a user might append a bogus ?something to the URL and you have to write the regex to take in account for such case...

    (Also the idea of the rules module given by mcrittenden is a good one, but I did not mention it as I thought to it only when I read his answer).

    Hope this helps!