Can I limit page editing to the user that created that page?

[tinacious]

Hi all, I am creating a site that will have multiple users in ProcessWire and I want to be able to limit the ability to edit pages so users can only edit the pages that they themselves created.

I noticed the default functionality allows you to assign roles yet anyone with this role appears to be able to edit whatever pages and templates have access to that role.

Thank you for your help! 

[teppo]

Problem here is that in order to add pages, user needs to be able to edit them too. One way to circumvent this would be a module that hooks to page::editable, checks if user has some predefined role you want to limit edit access for and (if that role is found) only grants edit access if this page was created by current user.

There are other ways too, but this is probably the one I'd suggest looking into. A very similar solution is described (in more detail) by Ryan here.

Hope this helps a bit.

[Macrura]

will the created pages be random throughout the site, or could each person's created pages be children of a certain page? if the latter is the case, maybe use page edit per user to limit access to that parent page; if page edit per user could maybe be modified to also limit child pages...

[tinacious]

Problem here is that in order to add pages, user needs to be able to edit them too. One way to circumvent this would be a module that hooks to page::editable, checks if user has some predefined role you want to limit edit access for and (if that role is found) only grants edit access if this page was created by current user.

There are other ways too, but this is probably the one I'd suggest looking into. A very similar solution is described (in more detail) by Ryan here.

Hope this helps a bit.

Hey teppo, thanks for the reply, this is the sort of thing I'm looking for. The "only grants edit access if this page was created by current user" is key. Any idea how to do this? You mention a module that hooks to page::editable. ProcessWire core already checks edit access on a per-template basis, would I need to address this when hooking into page::editable? Also, is this module publicly available? I would love to know how to go about this. Would you recommend creating a module, using the code Ryan wrote that you linked to, except altering the $page->name to be $page->createdUser? I haven't created modules yet so I'm wondering what the best way to go about this would be. Thanks! 

[tinacious]

Ok so I gave it a shot with creating a module by altering Ryan's code you linked to and this seems to be working so far (I think). Here's the module using that code teppo linked to, slightly modified to match my requirements:

<?php
/**
 * Edit Yours Only
 *
 */
class EditYoursOnly extends WireData implements Module {
	public static function getModuleInfo() {
		return array(
			'title' => 'Edit Yours Only', 
			'version' => 1, 
			'summary' => 'Custom module to allow users only to edit pages they created. Applies to role \'standard\'',
			'author' => 'Christina Holly, TinaciousDesign.com',
			'singular' => true, 
			'autoload' => true, 
			);
	}

	public function init() {
	    if($this->user->hasRole("standard")) $this->addHookAfter("Page::editable", $this, 'editable'); 
	}

	public function editable(HookEvent $event) {
	    // abort if no access
	    if(!$event->return) return; 
	    $page = $event->object; 
	    // criteria required in order to edit
	    if($this->user->name !== $page->createdUser->name) $event->return = false; 
	}
}

If anyone sees any problems that this could cause, please let me know. So far it appears to be working as I want it but I haven't tested it thoroughly.

Thanks!

[ryan]

It looks good to me. I would probably compare the $user's id rather than name, but I don't think it matters here. 

[tinacious]

Thanks everyone! Such swift responses from the ProcessWire community, love it!