Edit pages without page-edit rights

[webhoes]

Hello,

I am working on a site where multiple users have one ore more pages (studbook). These pages can contain children (animal) and animal can have a child (transfer).

I created an admin before the PW admin. Here users can see their the pages the have their users_created_id. I use the feel module for editing.

But if someone right clicks the edit button, they end up in the PW admin and can see everything (not allowed).

So I created a module to redirect everybody but superuser from the admin templates (except if page id == 10, the edit template).

This sort of makes is secure, but if a user knows the id of the page they can still type /processwire/page/edit/?id=xxxx and see that page.

I have been working some days around this, but no solid solution came up.

I do have the formbuilder module available if this can help.

I also thought of making a role for every studbook. That would mean 35 roles and 35 studbook templates. Also animal and transfer templates need to be duplicated per studbook otherwise a user will still be able to see others.

 

What other options are there to make it so people can only see their studbook and their child pages?

Nice to have would be that to or more selected users can see and or edit that studbook.

Preferbly all without page-edit rights so I can block everyone from the PW admin.

 

 

 

 

 

[elabx]

I think the Page::viewable hook might help you here:

<?php
wire()->addHookAfter('Page::viewable', function($event) {
    if(!$event->return) return; // already determined user has no access
    if(wire('user')->isSuperuser()) return; // superuser always allowed
    
    $page = $event->object; 
  	if($page->users_created_id != $this->user){
		//Don't let user view page
		$event->return = false;
	}
});