[drupal-devel] Working around node_access in node/add

Mark mark at nullcraft.org
Sun Feb 13 18:04:00 UTC 2005

Gerhard Killesreiter wrote:

>On Sat, 12 Feb 2005, Mark wrote:
>>Moshe Weitzman wrote:
>>>-1. Consider the case when we are retrieving a list of nodes. We don't
>>>want to call a hook against every single node we've retrieved. We want
>>>to retrieve only the right nodes in SQL. That is the whole point of
>>>the node_access table.
>>I'm looking to further restrict access using the node_access table as
>>well.  I only want to allow the creation of certain node types if  1)
>>they don't require a parent to exist or 2) I can tell from the query
>>params/environment/etc which node is the parent.  Failing both of these,
>>I don't want them to appear on the "create content" list.
>>Can you think oa another way to do this?
>Can't you just hide or disable the /node url and add a node creation
>interface for yourself?
>	Gerhard
Thats's basically what I'm trying to do.  I use a path of 
node/add/$type/parent/$parent_nid, and only want to require certain 
types to be created this way. Other nodes should be created using the 
normal node/add/$type url.  For the types that require a parent, I've 
tried overriding the menu path, but that doesn't seem to work.

Here's a snippet from my hook_menu:
function relativity_menu($may_cache) {
  global $_menu;
  $items = array();

    // * not working how I wanted it to
    // iterate through all node types and take over their node/add handlers
    foreach(node_list() as $type){
      if(relativity_requires_parent($type)) {
        drupal_set_message("<pre>$type: ".print_r($_menu['path 
        if($_menu['path index']['node/add/'.$type]) {
          drupal_set_message("altering access for type $type");
index']['node/add/'.$type]]['access'] = user_access('administer content');
index']['node/add/'.$type]]['title'] .= t(' requires parent');
        else {
          drupal_set_message("setting access for type $type");
          $items[] = array('path' => 'node/add/'. $type, 'title' => 
t('content type requires parent'),
            'callback' => 'node_page',
            'access' => user_access('administer content'),
            'type' => MENU_CALLBACK,
            'weight' => 1

At best, however, this only deals with the menu.  When node_add lists 
out possible node types to create, it calls upon node_access('create', 
$type) to determine whether to display the link or not.

I see node_access('create', $type) as being somewhat different from the 
other node_access operations.  It makes logical sense that the 'create' 
operation be part of this, but I don't think that the same restrictions 
that the other operations have comes into play.  There's generally no 
interaction with the node_access table when the 'create' operation is 
performed, since no specific node is named when the function is called.  
I think even a hook_nodeapi($type, 'create') that only gets invoked for 
the 'create' operation might work.  Anything that lets me override what 
node_access('create', $type) returns will suffice for my purposes, I 
think.  If you can think of non-core changes that would help me out 
here, I welcome your thoughts.

Thanks again,

More information about the drupal-devel mailing list