Club Drupal

# CONTENTS OF THIS FILE

* Introduction

* Requirements

* Recommended modules

* Installation

* Configuration

* Maintainers

* Notes

# INTRODUCTION

The **Content Access** module let you content manage access permission in a flexible and transparant way.

It provides two new permissions: *view all* (allows anyone to view the

content) and *view own* (allows only the content creator to see

his/her own content). It also gives access to the existing core

permissions *edit* and *delete* on the same settings page.

It provides the following modalities:

* Each *content type* can have its own default content access settings by role.

* Optionally you can enable role based access control settings per *content node*.

* Access control can be further customized per *user* if you have the **ACL** module enabled.

For more information and reporting, please visit:

* For a description of the module, visit the [project page][1].

* For on-screen documentation, visit the [documentation page][2],

  or enable [**Advanced Help**][6].

* To submit bug reports and feature suggestions, or to track changes

  visit the project's [issue tracker][3].

Features:

* It comes with sensible defaults, so you need not configure anything

  and everything stays working.

* It is as flexible as you want. It can work with per content type

  settings, per content node settings as well as with flexible Access

  Control Lists with the help of the **ACL** module

  ([see Note 1](#ACL) at the end).

* It reuses existing functionality instead of reimplementing it. So

  one can install the **ACL** module and set per user access control

  settings per content node.

* It comes with a submodule named **Content Access Rules

  Interations**. It provides conditions and actions for the **Rules**

  module, which allows one to configure rule-based access permissions.

* It optimizes the written content node grants, so that only the

  necessary grants are written.  This is important for the

  performance of your site.

* The module has a comes with automated testing to ensure everything

  stays working correctly.

* It respects and makes use of Drupal's core permissions. This means

  that the "Access Control" tab provided by this module takes them

  into account and provides you a good overview of *all* applied

  access control settings on a single page (but see [Note 2](#adv) at

  the end).

The module is designed to be simple to use, but can be configured to

provide really fine-grained content access permissions.

# REQUIREMENTS

None.

# RECOMMENDED MODULES

* [**ACL**][4]:

  To use Access Control Lists for per user access control.

* [**Advanced Help Hint**][7]:

  Links help text provided by `hook_help` to online help and

  **Advanced Help**.

* [**Advanced Help**][6]:

  When this module is enabled, the project's `README.md` will be

  displayed when you visit `help/content_access/README.md`.

* [**Markdown**][8]:

  When this module is enabled, display of the project's `README.md`

  will be rendered with the markdown filter.

* [**Node Export**][N]

  To export content access rules.

* [**Rules**][5]:

  To configure rule-based access permissions.

# INSTALLATION

The module is set up to require PHP ver. 5.6 or later.  I do not want

to keep supporting legacy PHP (at least not for free). If you need a

version that runs on something more ancient, you have two options:

1. Keep useing version 7.x-1.2-beta2. It does not restrict PHP

   version. It is very old tho', and is no longer recommended, nor is

   it supported.

2. Ask me to create a separate branch of the project for a backport

   the current supported version to whatever version of PHP you need.

   Then get someone to support this branch.

If you go for the backport option: If you're a developer, request to

become a co-maintainer of this project and then create and support the

backport yourself.  If you're not, sponsor someone to do the backport

and to support it.

To install and enable, do the following:

1. Install as you would normally install a contributed drupal

   module. See: [Installing modules][9] for further information.

2. Enable the **Content Access** module on the *Modules* list

   page.

3. If you want to use access control lists, download, install and

   configure the **ACL** module.

# CONFIGURATION

Note that users need at least the permission "View published content"

to be able to access published content. Furthermore note that content

which is not published is treated in a different way by Drupal: It can

be viewed only by its author or users with "Bypass content access

control" permission.  You can *not* use this project to manage

access to unpublished content.

To inspect and change those permissions, navigate to *Administration »

People » Permisions* and scroll down to the "Node" section.

## Role based access control

To set up access control for a content type, navigate to

*Administration » Structure* and click on "edit" for the content type

you want to set up.  There will be a new tab named "Access Control"

that let you control access.

To set up role based access control, tick the boxes under "Role based

access control settings".  Note that only the "View" permissions are

new permissions provided by this module.  The "Edit" and "Delete"

permissions are provided by the Drupal core, and can also be found if

you navigate to *Administration » People » Permisions*.  They are

shown here to provide the full picture of what permission is set for

the content type and role. It does not matter where you change these.

## Per content node access control

There is a a checkbox to enable per content node access control

settings.  If enabled, a new tab for the content access settings

appears when viewing content.

To configure permission to access these settings, navigate to

*Administration » People » Permisions* and set the "Grant content

access" permission for the relevant roles.

## Advanced access control

The "Advanced" settings are only relevant if you are running multiple

node access modules on a site.

A Drupal node access module can only grant access to content nodes,

but not deny it. So if you are using multiple node access modules,

access will be granted to a node as soon as one of the module grants

access to it.

However you can influence the behaviour by changing the priority of

the content access module as drupal applies *only* the grants with the

highest priority. So if content access has the highest priority

*alone*, only its grants will be applied.

By default node access modules should use priority 0 (zero).

## Using access control lists

To make use of access control lists you'll need to enable per content

node access control settings for the content type. At the access control

tab of such a content node you are able to grant view, edit or delete

permission for specific users..

# MAINTAINERS

**Content Access** was created by [fago][10] (Wolfgang Ziegler).  

It contains a lot of contributions from  [good_man][11] (Khaled Al Hourani).  

The current maintainer is [gisle][12] (Gisle Hannemyr).

Development and maintenance is sponsored by [Hannemyr Nye Medier AS][13].

Any help with development (patches, reviews, comments) are welcome.

# NOTES

**Note 1**<a id="ACL"></a>: ACL integration is not yet working right.

**Note 2**<a id="adv"></a>: Note that this overview can't take other

modules into account, which might also alter node access.  If you have

multiple modules installed that alter node access, read the paragraph

about "Advanced access control".

[1]: https://drupal.org/project/content_access

[2]: https://drupal.org/node/1194974

[3]: https://drupal.org/project/issues/content_access

[4]: https://www.drupal.org/project/acl

[5]: https://www.drupal.org/project/rules

[6]: https://www.drupal.org/project/advanced_help

[7]: https://www.drupal.org/project/advanced_help_hint

[8]: https://www.drupal.org/project/markdown

[N]: https://www.drupal.org/project/node_export

[9]: https://www.drupal.org/docs/7/extend/installing-modules

[10]: https://www.drupal.org/u/fago

[11]: https://www.drupal.org/u/good_man

[12]: https://www.drupal.org/u/gisle

[13]: https://hannemyr.no

    '#access' => !empty(content_access_get_per_node_settings($node)),

  cache_clear_all();

  module_invoke_all('per_node', $settings, $node);

  drupal_set_message(t('Your changes have been saved. You may have to !rebuild for your changes to take effect.', array('!rebuild' => l(t('rebuild permissions'), 'admin/reports/status/rebuild'))));

  drupal_set_message(t('The permissions have been reset to the content type defaults.'));

  drupal_set_message(t('Your changes have been saved. You may have to !rebuild for your changes to take effect.', array('!rebuild' => l(t('rebuild permissions'), 'admin/reports/status/rebuild'))));

    '#description' => t('Note that users need at least the %view_published_content permission to be able to deal in any way with content.', array('%view_published_content' => t('view published content'))) .

      ' ' . t('Furthermore note that content which is not @published is treated in a different way by drupal: It can be viewed only by its author or users with the %bypass_node_access permission.', array('@published' => t('published'), '%bypass_node_access' => t('bypass content access control'))),

}

php = 5.6

; Information added by Drupal.org packaging script on 2020-06-25

version = "7.x-1.2-beta3"

datestamp = "1593095998"

  $settings_new = array();

      $output .= '<p>' . t('The <strong>Content Access</strong> module let you content manage access permission in a flexible and transparant way.') . '</p>';

      $output .= '<h3>' . t('Use') . '</h3>';

      $output .= '<p>' . t('It provides two new permissions: <em>view all</em> (allows anyone to view the content) and <em>view own</em> (allows  only the content creator to see his/her own content). It also gives access to the existing core permissions <em>edit</em> and <em>delete</em> on the same settings page.') . '</p>';

      $output .= '<p>' . t('It provides the following modalities:') . '</p><ul>';

      $output .= '<li>' . t('Each <em>!content-type</em> can have its own default content access settings by role.',  array('!content-type' => l('content type', 'admin/structure/types'))) . '</li>';

      $output .= '<li>' . t('Optionally you can enable  role based access control settings per <em>content node</em>.') . '</li>';

      $output .= '<li>' . t('Access control can be further customized per <em>user</em> if you have the <strong>!acl</strong> module enabled.',

        array('!acl' => l('ACL', 'https://www.drupal.org/project/acl/'))) . '</li></ul>';

      if (function_exists('advanced_help_hint_docs')) {

        $output .= '<p>' . advanced_help_hint_docs('content_access', 'https://drupal.org/node/1194974', TRUE) . '</p>';

      }

      else {

        $output .= '<p>' .t('If you install and enable the module <strong>!url</strong>, you will get more help for <strong>Content Access</strong>.',

          array('!url' => l('Advanced Help Hint', 'https://www.drupal.org/project/advanced_help_hint'))) . '</p>';

      }

  // Do not store default values so we do not have to care about syncing our

 *   The roles with which only the author has access (optimized!)

 *   Optional array used to update the settings cache with the given settings.

  $admin_roles = content_access_get_permission_access('bypass node access');

      // Fix the checkbox to be enabled for users with bypass node access privileges

      $element[$key]['#prefix'] = '<span' . drupal_attributes(array('title' => t("This role has '@perm' permission, so access is granted.", array('@perm' => t('bypass node access'))))) . '>';

}

/**

 * Implements hook_node_export_alter().

 */

function content_access_node_export_alter(array $nodes) {

  foreach ($nodes as $node) {

    $node->content_access = content_access_get_per_node_settings($node);

  }

}

/**

 * Implements hook_node_export_after_import_alter().

 */

function content_access_node_export_after_import_alter(array $nodes) {

  foreach ($nodes as $node) {

    if(empty($node->nid))

      continue;

    content_access_save_per_node_settings($node, $node->content_access);

  }

  // Rebuild content access permissions

  node_access_rebuild();

}

; Information added by Drupal.org packaging script on 2020-06-25

version = "7.x-1.2-beta3"

datestamp = "1593095998"

function content_access_rules_per_node($settings, $node) {

  rules_invoke_event('content_access_per_node', $node);

}

  $events['content_access_per_node'] = array(

    'label' => t('Per node access control was changed'),

    'variables' => array(

      'node' => array('type' => 'node', 'label' => 'Content with updated content access'),

    ),

  );

    $items[$name] = $event + array(

      (isset($node->op) && $node->op != t('Save'))) {

}

[advanced help settings]

show readme = TRUE

[rules]

title = Rules

weight = -11

[nodeexport]

title = Node Export

weight = -10

[integration]

title = Integration with other modules

weight = -9

<h2>Introduction</h2>

<p>This section contains notes about how to integrate <strong>Content

Access</strong> with other modules.</p>

<p>I have not tested these myself, so I do not guarantee that the

suggestion collected below actually work.  They are just to keep the

links to the workarounds posted somewhere on the web in a single

file.</p>

<p>If you spot link rot, or wrong information, on this page, please

report it using the project's

<a href="https://drupal.org/project/issues/content_access">issue queue</a>.</p>

<h2>Varnish, Cachewall</h2>

<p><em>Varnish</em> and other cache systems such as <em>Cachewall</em>

by default will delete cookies before they reach Drupal, so everybody

becomes an anonymous user. This precludes access to private file

attachments.</p>

<p>Below are settings for <em>Varnish</em> to prevent this for some

file types:</p>

<pre>

# Always cache the following file types for all users. This list of extensions

# appears twice, once here and again in vcl_fetch so make sure you edit both

# and keep them equal.

if (req.url ~ "(?i)\.(pdf|txt|csv|png|gif|jpg|ico|swf|css|js)(\?.*)?$") {

  unset req.http.Cookie;

}

</pre>

<ul>

<li>Drupal.org: <a href="https://www.drupal.org/project/content_access/issues/2682635">Issue #2682635</a></li>

<li>Drupal.org: <a href="https://www.drupal.org/project/webform/issues/2421429#comment-9667677">Issue #2421429, comment #4</a></li>

</ul>

<h2>Views and Workbench</h2>

<p>If you have problems intgrating <strong>Views</strong> and/or <strong>Workbench</strong>,

in particular in connection with the  “<em>View own unpublished content</em>” permission,

one of these links may help:</p>

<ul>

<li>Drupal.org: <a href="https://www.drupal.org/project/content_access/issues/2204609">Issue #2205609</a></li>

<li>Drupal Answers: <a href="https://drupal.stackexchange.com/q/41997/12076">Problem with “Content Access” and permission “View own unpublished content”</a>.</li>

<li>Drupalprimer: <a href="http://drupalprimer.com/node/2">Drupal 7's Access Control module prevents view of user's own unpublished content</a>.</li>

</ul>

<p>Problems using relationships in <strong>Views</strong> may be solved by patching core:</p>

<ul>

<li>Drupal.org: <a href="https://www.drupal.org/project/content_access/issues/2020453">Issue #2020453</a></li>

<li>Drupal.org: <a href="https://www.drupal.org/project/drupal/issues/1349080#comment-10953027">Issue #1349080, comment #332</a></li>

</ul>

<h2>Introduction</h2>

<p>This page is just a placeholder. Until it is populated, please see:</p>

<ul>

<li>Drupal.org: <a href="https://www.drupal.org/project/content_access/issues/2661872">Issue #2661872</a></li>

</ul>

<h2>Introduction</h2>

<p>This section contains notes about how to

integrate with <strong>Rules</strong>.</p>

<p><strong>Note</strong>: This only work on individual nodes.  The

rules for access control that you set up will not be

executed <em>unless</em> you have enabled per content node access

control settings.</p>

<h2>Rules integrations example</h2>

<p>In this example, there will be two user roles: “writer” and

“editor”. There will also be two users: A writer named “Bob” and an

editor named “Ben”.  There will also be a third user named “Alice”

that will not belong to any of there roles. We shall set up a workflow

where “Bob” creates content, and when that content is saved, only

users with the “editor” user role (e.g. “Ben”) will be allowed to see

it.</p>

<p>Set up:</p>

<ul>

<li>Ensure <strong>Content Access</strong> is enabled (if you can read this in the browser, it is).</li>

<li>Enable both the <strong>Rules</strong> and <strong>Rules UI</strong> modules.</li>

<li>Enable the <strong>Content Access Rules Integrations</strong> module.</li>

<li>Create the roles: “writer” and “editor” and the users “Bob”, “Ben” and “Alice”. Assign roles.</li>

<li>Set up default role based access control settings.  Give the “anonymous user” role and the “authenticated user” role access to “View any article content” and “View own article content”.</li>

<li>Check “Enable per content node access control settings”. You find this checkbox under the “Access Control” tab located on the settings page for the content type.</li>

</ul>

<p>Create the rules:</p>

<ul>

<li>Navigate to <span class="nav">Configuration » Workflow » Rules<span>.</li>

<li>Click “Add new rule”.</li>

<li>Name the rule “editor oversight”.</li>

<li>Leave the field “Tags” empty.</li>

<li>In the pulldown menu for “React on event”, select “After saving new contents”.</li>

<li>Leave “Restrict by type” set to “- None -”.</li>

<li>Click “Save”.</li>

</ul>

<div class="help-imgpos-center" style="max-width:620px">

<img class="help-img" alt="ahelp_tab.png" title="New rule: Editor oversight" src="&path&rules01.png" width="620" />

<div class="help-img-caption" style="max-width:620px">Adding a new rule</div>

</div>

<p>This sets up a new rule named “editor oversight” that triggers when

a new node is saved.</p>

<ul>

  <li>Under “Conditions”, click “Add condition”,</li>

  <li>From the pulldown menu  “Select <em>condition</em> to add”, select “User has role(s)”.</li>

  <li>After making the selection, you automatically continue to a new page to set up a data selector.</li>

  <li>For the “Data selector” field, choose “node:author”.</li>

  <li>Under “Roles”, for “Value”, select “writer”.</li>

<li>Click “Save”.</li>

</ul>

<p>This sets up a contition for following the rule. The rule is only

followed when the user with the role “writer” triggers an event that

matches “After saving new contents”.</p>

<p>The final step adds an action that happens when the rule is

triggered and the conditions are met.</p>

<ul>

  <li>Under “Actions”, click “Add action”,</li>

  <li>From the pulldown menu “Select <em>action</em> to add”, select “Grant Access by role”.</li>

  <li>After making the selection, you automatically continue to a new page to set up role based access settings.</li>

  <li>Look under “Role-based access control settings”. Give the “editor” the right to “View any content” “View own content”. Checking a box grants the access.</li>

  <li>Under “Actions”, again click “Add action”,</li>

  <li>From the pulldown menu “Select <em>action</em> to add”, select “Revoke Access by role”.</li>

  <li>After making the selection, you automatically continue to a new page to set up role based access settings.</li>

  <li>Look under “Role-based access control settings”. Revoke “View any content” “View own content” for the “anonymous user” role and the the “authenticated user” role.  Checking a box revokes the access.</li>

  <li>Click “Save”.</li>

</ul>

<p>Verify that it works:</p>

<ul>

<li>Create an artcle as “Alice” (no special role). Verify that is viewable by everyone.</li>

<li>Create an artcle as “Bob” (the writer). Verify that is viewable by “Ben” (the editor), but not by “Alice”.</li>

</ul>

 * Automated SimpleTest Case for content access module.

require_once drupal_get_path('module', 'content_access') . '/tests/content_access_test_help.php';

   * Implements get_info() for information.

    // Create test nodes.

   * Test for viewing nodes.

    // Restrict access to the content type (access is only allowed for the

    // author).

    // Logout admin and try to access the node anonymously.

    $this->drupalGet('node/' . $this->node1->nid);

    // Login test user, view node, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid);

    // Login admin and grant access for viewing to the test user.

    // Logout admin and try to access the node anonymously.

    // Access must be denied again.

    $this->drupalGet('node/' . $this->node1->nid);

    // Login test user, view node, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid);

    // Login admin and enable per node access.

    // Restrict access on node2 for the test user role.

    // Logout admin and try to access both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid);

    $this->drupalGet('node/' . $this->node2->nid);

    // Login test user, view node1, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid);

    // View node2, access must be denied.

    $this->drupalGet('node/' . $this->node2->nid);

    // Login admin, swap permissions between content type and node2.

    // Restrict access to content type.

    // Grant access to node2.

    // Logout admin and try to access both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid);

    $this->drupalGet('node/' . $this->node2->nid);

    // Login test user, view node1, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid);

    // View node2, access must be granted.

    $this->drupalGet('node/' . $this->node2->nid);

   * Test for editing nodes.

    // Logout admin and try to edit the node anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Login test user, edit node, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Login admin and grant access for editing to the test user.

    // Logout admin and try to edit the node anonymously.

    // Access must be denied again.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Login test user, edit node, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Login admin and enable per node access.

    // Restrict access for this content type for the test user.

    // Allow acces for node1 only.

    // Logout admin and try to edit both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    $this->drupalGet('node/' . $this->node2->nid . '/edit');

    // Login test user, edit node1, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Edit node2, access must be denied.

    $this->drupalGet('node/' . $this->node2->nid . '/edit');

    // Login admin, swap permissions between node1 and node2.

    // Grant edit access to node2.

    // Restrict edit acces to node1.

    // Logout admin and try to edit both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    $this->drupalGet('node/' . $this->node2->nid . '/edit');

    // Login test user, edit node1, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid . '/edit');

    // Edit node2, access must be granted.

    $this->drupalGet('node/' . $this->node2->nid . '/edit');

   * Test for deleting nodes.

    // Logout admin and try to delete the node anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    // Login test user, delete node, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    // Login admin and grant access for deleting to the test user.

    // Logout admin and try to edit the node anonymously.

    // Access must be denied again.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    // Login test user, delete node, access must be granted.

    $this->drupalPost('node/' . $this->node1->nid . '/delete', array(), 'Delete');

    // Login admin and recreate test node1.

    // Enable per node access.

    // Restrict access for this content type for the test user.

    // Allow acces for node1 only.

    // Logout admin and try to delete both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    $this->drupalGet('node/' . $this->node2->nid . '/delete');

    // Login test user, delete node1, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    // Delete node2, access must be denied.

    $this->drupalGet('node/' . $this->node2->nid . '/delete');

    // Login admin, swap permissions between node1 and node2.

    // Grant delete access to node2.

    // Restrict delete acces to node1.

    // Logout admin and try to delete both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    $this->drupalGet('node/' . $this->node2->nid . '/delete');

    // Login test user, delete node1, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid . '/delete');

    // Delete node2, access must be granted.

    $this->drupalGet('node/' . $this->node2->nid . '/delete');

   * Test own view access.

    // Setup 2 test users.

    $test_user2 = $this->drupalCreateUser(array('access content'));

    // Change ownership of test nodes to test users.

    // Remove all view permissions for this content type.

    // Allow view own content for test user 1 and 2 roles.

    // Logout admin and try to access both nodes anonymously.

    $this->drupalGet('node/' . $this->node1->nid);

    $this->drupalGet('node/' . $this->node2->nid);

    // Login test user 1, view node1, access must be granted.

    $this->drupalGet('node/' . $this->node1->nid);

    // View node2, access must be denied.

    $this->drupalGet('node/' . $this->node2->nid);

    // Login test user 2, view node1, access must be denied.

    $this->drupalGet('node/' . $this->node1->nid);

    // View node2, access must be granted.

    $this->drupalGet('node/' . $this->node2->nid);

}

    // Create test user with separate role.

    $this->test_user = $this->drupalCreateUser(array('access content'));

    // Get the value of the new role.

    // Needed in D7 because drupalCreateUser() creates two roles for new users:

    // one role is Authenticated and the second has the given permissions.

    $roles = $this->test_user->roles;

    unset($roles[DRUPAL_AUTHENTICATED_RID]);

    $this->rid = key($roles);

    $this->admin_user = $this->drupalCreateUser(array('access content', 'administer content types', 'grant content access', 'grant own content access', 'bypass node access', 'administer nodes', 'access administration pages'));

}