Join Log in
Score:0
avatar Drupal

How to limit access to the Views pages of the user account?

cn flag
zoulou66

I created Views page with tabs in the users account.

The problem: If I am user 3 and I go to the page of user 56, I have access to the page.

I have searched in the Contextual filters on the Views page and there is no setting to limit this.

How do I limit access to the Views pages of the user account ? The current user must have access to all the pages of his own account, but not to those of other users.

EDIT

Here is a very simple Views page for the user account. How do I display a 403 page if I go to another user page ?

EXAMPLE :

I am the user ID:88 I have access to the page /user/88/demo

I must not have access to /user/69/demo

uuid: faef0cd7-9481-4a11-920e-77b683989956
langcode: fr
status: true
dependencies:
  config:
    - core.entity_view_mode.node.teaser
  module:
    - node
    - user
id: demo
label: Demo
module: views
description: ''
tag: ''
base_table: node_field_data
base_field: nid
display:
  default:
    id: default
    display_title: Default
    display_plugin: default
    position: 0
    display_options:
      title: Demo
      fields:
        title:
          id: title
          table: node_field_data
          field: title
          relationship: none
          group_type: group
          admin_label: ''
          entity_type: node
          entity_field: title
          plugin_id: field
          label: ''
          exclude: false
          alter:
            alter_text: false
            make_link: false
            absolute: false
            word_boundary: false
            ellipsis: false
            strip_tags: false
            trim: false
            html: false
          element_type: ''
          element_class: ''
          element_label_type: ''
          element_label_class: ''
          element_label_colon: true
          element_wrapper_type: ''
          element_wrapper_class: ''
          element_default_classes: true
          empty: ''
          hide_empty: false
          empty_zero: false
          hide_alter_empty: true
          click_sort_column: value
          type: string
          settings:
            link_to_entity: true
          group_column: value
          group_columns: {  }
          group_rows: true
          delta_limit: 0
          delta_offset: 0
          delta_reversed: false
          delta_first_last: false
          multi_type: separator
          separator: ', '
          field_api_classes: false
      pager:
        type: mini
        options:
          offset: 0
          items_per_page: 10
          total_pages: null
          id: 0
          tags:
            next: ››
            previous: ‹‹
          expose:
            items_per_page: false
            items_per_page_label: 'Items per page'
            items_per_page_options: '5, 10, 25, 50'
            items_per_page_options_all: false
            items_per_page_options_all_label: '- All -'
            offset: false
            offset_label: Offset
      exposed_form:
        type: basic
        options:
          submit_button: Apply
          reset_button: false
          reset_button_label: Reset
          exposed_sorts_label: 'Sort by'
          expose_sort_order: true
          sort_asc_label: Asc
          sort_desc_label: Desc
      access:
        type: perm
        options:
          perm: 'access content'
      cache:
        type: tag
        options: {  }
      empty: {  }
      sorts:
        created:
          id: created
          table: node_field_data
          field: created
          relationship: none
          group_type: group
          admin_label: ''
          entity_type: node
          entity_field: created
          plugin_id: date
          order: DESC
          expose:
            label: ''
            field_identifier: ''
          exposed: false
          granularity: second
      arguments:
        uid:
          id: uid
          table: node_field_data
          field: uid
          relationship: none
          group_type: group
          admin_label: ''
          entity_type: node
          entity_field: uid
          plugin_id: numeric
          default_action: default
          exception:
            value: all
            title_enable: false
            title: All
          title_enable: false
          title: ''
          default_argument_type: user
          default_argument_options:
            user: false
          default_argument_skip_url: false
          summary_options:
            base_path: ''
            count: true
            override: false
            items_per_page: 25
          summary:
            sort_order: asc
            number_of_records: 0
            format: default_summary
          specify_validation: false
          validate:
            type: none
            fail: 'not found'
          validate_options: {  }
          break_phrase: false
          not: false
        uid_1:
          id: uid_1
          table: node_field_data
          field: uid
          relationship: none
          group_type: group
          admin_label: ''
          entity_type: node
          entity_field: uid
          plugin_id: numeric
          default_action: ignore
          exception:
            value: all
            title_enable: false
            title: All
          title_enable: false
          title: ''
          default_argument_type: fixed
          default_argument_options:
            argument: ''
          default_argument_skip_url: false
          summary_options:
            base_path: ''
            count: true
            override: false
            items_per_page: 25
          summary:
            sort_order: asc
            number_of_records: 0
            format: default_summary
          specify_validation: true
          validate:
            type: 'entity:user'
            fail: 'access denied'
          validate_options:
            access: true
            operation: update
            multiple: 0
            restrict_roles: false
            roles: {  }
          break_phrase: false
          not: false
      filters:
        status:
          id: status
          table: node_field_data
          field: status
          entity_type: node
          entity_field: status
          plugin_id: boolean
          value: '1'
          group: 1
          expose:
            operator: ''
            operator_limit_selection: false
            operator_list: {  }
      style:
        type: default
      row:
        type: 'entity:node'
        options:
          view_mode: teaser
      query:
        type: views_query
        options:
          query_comment: ''
          disable_sql_rewrite: false
          distinct: false
          replica: false
          query_tags: {  }
      relationships: {  }
      header: {  }
      footer: {  }
      display_extenders: {  }
    cache_metadata:
      max-age: -1
      contexts:
        - 'languages:language_content'
        - 'languages:language_interface'
        - url
        - url.query_args
        - 'user.node_grants:view'
        - user.permissions
      tags: {  }
  page_1:
    id: page_1
    display_title: Page
    display_plugin: page
    position: 1
    display_options:
      display_extenders:
        simple_sitemap_display_extender: {  }
        metatag_display_extender: {  }
      path: user/%user/demo
      menu:
        type: tab
        title: Demo
        description: ''
        weight: 0
        expanded: false
        menu_name: main
        parent: ''
        context: '0'
    cache_metadata:
      max-age: -1
      contexts:
        - 'languages:language_content'
        - 'languages:language_interface'
        - url
        - url.query_args
        - 'user.node_grants:view'
        - user.permissions
      tags: {  }
49
0 + 0
9
Score:0
Jaypan avatar Drupal
de flag
Jaypan

You can do the following:

  1. In the Contextual filters for the view
  2. Check specify validation criteria
  3. Check Validate the user has access to the User
  4. Under Access operation to check choose edit.

This will limit access to the user themselves, and mods/admins who are able to edit their account.

Other considerations

You can relax those permissions by choosing view for the access operation, however if authenticated or anonymous users have permission to view other users profiles on the site, they will also have access to this view/page. This would appear to be the situation in the original question, so view would not work for the OP. But for other sites where users are not able to access other user's profiles, this could be an option.

Further permissions could be configured by creating a new custom permission (in a module), for example view my custom page, and add that as permission on the access settings for the view. This would add for an additional level of access configuration.

0 + 0
cn flag
zoulou66
Thanks, I updated my question with an example. If I add a second pop-up filter with your solution, it doesn't work.
0
Reply
Jaypan avatar
de flag
Jaypan
I don't understand what that means. What is a second popup filter?
0
Reply
Jaypan avatar
de flag
Jaypan
This looks like you have not followed the steps from my example: `specify_validation: false`
0
Reply
cn flag
zoulou66
I made the wrong export, I updated
0
Reply
cn flag
zoulou66
In the example. I want a page with the user created content and I want that if the user goes to the same page on another account the page will show a 403 page
0
Reply
Jaypan avatar
de flag
Jaypan
Ok. Follow the instructions in my example above.
0
Reply
cn flag
zoulou66
yes, thank you ;-)
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.