3

I'm wondering about best practice, and if I'm setting myself up for trouble.

The goal: Limit an editor's Safecracker access to specific entries within a channel, based on the member group of the editor.

The setup: I'm using Zoo Visitor for members as channel entries. Thinking of using categories to limit Safecracker access within a channel.

An example: my_member_channel has an entry named Dan, who is in my_editors member group. Dan needs to be able to edit other users in the my_member_channel that have the category "Editor Category" selected, but no others.

This seems to work:

    {exp:channel:entries channel="my_member_channel" limit="1"}

    {categories}

        {if category_id == 1 && (member_group == '6' || member_group == '8')}
            {!-- 
                If the category "Editor Category" (1) is selected, and the logged in user is in my_standard_admin (6) or my_editors (8) member group. 
                --}

            {exp:safecracker 
                channel="my_member_channel" 
                entry_id="{segment_3}" 
            }

                Various fields in the channel to be edited here,
                including a Matrix field with a Playa column:
                {field:my_matrix_field}

                submit button
            {/exp:safecracker}          

        {/if}

    {/categories}

{/exp:channel:entries}

I tested this lightly, but it seems to work fine. So if I continue down this route I'll create "pseudo member categories" to be used in various channels and then conditionally check before showing the Safecracker form.

Am I missing a much more stable approach? I would prefer doing this all using the CP, but can't seem to work out a way to dole out the permissions in a custom enough way, therefore Safecracker.

1

i wouldn't wrap safecracker inside a channel:entries tag. Fields like title, url_title etc. might collide. You can use an embed with safecracker (pass thru data) or use stash to capture info from the other channel first, and stash:get inside safecracker to show/hide information.

If there are multiple categories assigned, you might also want to limit the output of the {categories} tag with show="" and limit="" parameters:
http://ellislab.com/expressionengine/user-guide/modules/channel/channel_entries.html#categories-tag-pair-parameters

2
  • Appreciate the help and good advice. So using categories (+ member groups) for safecracker permissions isn't crazy? Apr 30 '13 at 3:25
  • Nope, not crazy. By default there is no fine grained access control in EE. A member (group) can either publish entries in a channel or not, and can edit entries published by others or not. There's also an add-on called Entry-access
    – GDmac
    May 1 '13 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.