Avoid outputting "unauthorised internal page" links on front-end

[LAPS]

In my PW website many pages are using CKEditor fields that contain links pointing to other internal pages of the website. Since some pages to which links point to are only accessible to specific user roles, I would like to not show on the front-end the "unauthorised internal page" links (<a href="..."></a>) to not authorised users but just plain text.

What do you recommend to avoid outputting those "unauthorised internal page" links? Should I remove/transform such links from within the text before rendering them on the front-end  by using a PW hook? If so, e.g. what hook should I use, and how to check the "unauthorised internal page" links and replace them with plain text?

[Ivan Gretsky]

There is a specific type of modules in PW called Text Formatters for doing just that. They parse text field contents before they get output and can change things based on regular expressions. Just make a new text formatter module based on something simple like this and adjust it to your needs.

You probably could change the initial behaviour somehow too if this solution does not work out.

[LAPS]

Hello @Ivan Gretsky, I'm trying to create my first module and it would be great if you could help me in writing the code to replace unauthorised internal page links with plain text.

What I did so far is:

<?php namespace ProcessWire;

class TextformatterObfuscateUnAuthInternalPageLinks extends Textformatter {

  public static function getModuleInfo() {
    return array(
      'title' => __('Textformatter Obfuscate Unauthorised Internal Page Links', __FILE__),
      'version' => 1,
      'summary' => __("Replaces HTML links pointing to unauthorised internal pages with plain text", __FILE__),
    );
  }

  public function format(&$content) {
    // search for <a> HTML tags and replace unauthorised internal page links
    $dom = new DOMDocument;
    $dom->loadHTML($content);
    foreach ($dom->getElementsByTagName('a') as $node) {
      $href = wire('sanitizer')->url($node->getAttribute('href'));
      $_page = wire('pages')->get("path=$href");

      // if $_page exists (has been found)...
      if($_page->id) {
        // ... if user has not page-view permission for $_page
        if(!wire('user')->hasPermission('page-view', $_page)) {
          // ... transform link to plain text
		
          // (perhaps, only) here I need your help for removing/transforming the $node link...
        
        }
      }
    }
  }
}

Note: I didn't tested this code yet. ☺️