Easy-to-follow video tutorials help you learn software, creative, and business skills.Become a member

Controlling access to data

From: Drupal 7: Reporting and Visualizing Data

Video: Controlling access to data

So we've created a list of our employees, but is that really something we want to make available to the whole world? Probably not. So I am going to make some changes to limit our access to it. Now, before I start I should mention that limiting access to a view is only one part of the security solution. The information will still be available and visitors will be able to find it by searching, but I will also point you to some resources for fixing those problems. To show this we need to look at our site as if we were a casual visitor. The way I did that is by opening a different browser program, not just a new window, but an entirely new program.

Controlling access to data

So we've created a list of our employees, but is that really something we want to make available to the whole world? Probably not. So I am going to make some changes to limit our access to it. Now, before I start I should mention that limiting access to a view is only one part of the security solution. The information will still be available and visitors will be able to find it by searching, but I will also point you to some resources for fixing those problems. To show this we need to look at our site as if we were a casual visitor. The way I did that is by opening a different browser program, not just a new window, but an entirely new program.

So I am looking at the site as an administrator here in Firefox, but then if I switch over to Google Chrome, you can see that I'm looking at it as if I'm a visitor, and we know that I'm a visitor because we have this User login over here. Another way to tell in Drupal is by typing user at the end of your domain. If you get this Login box, that means that you're not logged in already, whereas if I am a logged in user and I'm switching back here to Firefox, I see my own profile. A visitor who is not logged in is called an anonymous user in Drupal speak.

Those who are logged in are called authenticated users. Anyway, let's go back to our Employee list and start limiting access to it. As usual we go up and we Edit the view. Right now, we're just looking at the Page View, and you will notice that there's something under Page Settings for Access. We can limit Access either by Permission or by Role, and as you can see, we can limit it just to this display or to all displays. I will briefly explain the difference between Permissions and Roles, but for the full details see Drupal 7 Essential Training from lynda.com.

For us, I am going to change it to Role, and then Apply. We then have a choice of which roles we want to allow to see this page, and in fact, all of the displays. I am going to say that we only want authenticated users and the administrators to see it, not the non- logged in anonymous users. In fact, I will do that for all of my displays. So I do that and click Apply. We Save our view and then let's test it. Since we are an administrator, we can still see this both in the list and then in the block down here, but if we switch over to our Chrome browser, go back to the front page where remember we usually see a view. Access denied.

In fact, that block has also disappeared from this left column. So it works! That's just the basic solution, but there's a big problem with it. Each one of these records is a node in Drupal and we haven't actually limited the access to those nodes. If our visitor happens to know Drupal pretty well, they know that if they simply type node/ a number, they will get one of the nodes in the site. Let's try node/1. Yup! This visitor can still see the private information of poor Dani Smith and, furthermore, the data is searchable.

I can show you that by going back to the administrator site and giving that anonymous user the ability to search. It's not there by default, but many sites turn it on. We click People, and then go up to Permissions, and then scroll down until we get to the Search group, which is way down near the bottom. Let's let them use Search and Save. Now if we go back to Google Chrome and reload, we see a search box. If I do a search, for example, for office, holy cow, I see everything. I see people who work in the front office, in the back office, suddenly I still have access to all the stuff.

So you not only have to hide the view, but also the information itself. There is a nuclear option for doing that. You could simply turn off access to all content. I will go back to my administrative page and scroll down this list of Permissions. One of the permissions is View publish content. If I turn that off and Save, then I can go back to my site and reload. They can't see anything. If I were to try /node/1, I again get Access denied.

But in our case I am just going to go back and re-enable that permission. We may be using it later in the course. So View published content, I will let them see it again. I'm also going to turn off that Use search, just for safety's sake. Save permissions, and if we go back to Chrome, we are back the way we were. We can see individual nodes, but we can't search for them. There are several other ways that you can hide this content from anonymous users and some of them give you a lot more control. If you want to see them, go to the drupal.org Modules page.

You will find that at drupal.org/project/modules. Once there, Filter by the version of Drupal you have. In our case it's Drupal 7. Then under Categories look at Content Access Control and search. Wow! 40 Modules that let you limit the access. The one that I'm going to show you very quickly is called Nodeaccess. You might find that one of the others fits your needs better, so don't be shy about looking around and trying all of these if node access doesn't do what you want. It's at drupal.org/project/nodeaccess. I'll scroll down and install it the usual way.

Right-click on the gz file, Copy it, go back to my site, Modules, and Install. I then Enable it. Scroll down until I see it in the Other group. I Enable it and Save. When you've done that it gives us a warning. We have to rebuild permissions. So I'll go ahead and do that, and then we go on to configure it. Click Configuration and Nodeaccess. The one that we want to control for is Employee. So I click that link and remove the View permission from anonymous users. It's that simple.

Go down and Save Grants. Once again we rebuild permissions and now we've blocked all the access that we had before for anonymous users. If we were to try to go to node/1 again, nope, still Access denied. Terrific! We've now installed basic data protection on our site, but if the information is really important, you can't stop there, because there are still some potential holes. For example, we haven't prevented other roles from accessing employee information, and going even deeper, anyone who can look at certain files on the server will be able to get all of that data as well.

Fortunately, the Drupal community has really stepped up to the plate and provided a lot of information about security. Your first stop, as always, is drupal.org. Once there, search for security. To narrow it down further, you can take a look at some of the groups available by clicking here, Best Practices and so forth, or you can look at the documentation, Securing your site, that's a good place to start. If you prefer books, Cracking Drupal puts it all in one place. You can learn about that book at crackingdrupal.com.

But for most data protection purposes the lessons you saw in this video should be enough.

Show transcript

This video is part of

Image for Drupal 7: Reporting and Visualizing Data
Drupal 7: Reporting and Visualizing Data

44 video lessons · 6750 viewers

Tom Geller
Author

 
Expand all | Collapse all
  1. 13m 50s
    1. Welcome
      50s
    2. What you need to know
      4m 49s
    3. Using the exercise files
      8m 11s
  2. 12m 58s
    1. A yoga studio
      3m 18s
    2. A national organization
      2m 51s
    3. An entertainment company
      4m 3s
    4. An organization with hyperlocal branches
      2m 46s
  3. 40m 49s
    1. Planning your site's data structure
      3m 31s
    2. Creating record templates
      5m 40s
    3. Understanding Drupal 7's data-template model (entities)
      4m 27s
    4. Creating categories using two methods
      6m 14s
    5. Creating unusual field types
      6m 38s
    6. Reusing and grouping fields
      6m 25s
    7. Looking at Drupal's database
      3m 56s
    8. Migrating custom fields from Drupal 6
      3m 58s
  4. 20m 46s
    1. Connecting two fields using references
      5m 35s
    2. Importing data using Feeds
      8m 48s
    3. Changing the appearances of fields
      6m 23s
  5. 53m 15s
    1. Understanding why views are useful
      5m 1s
    2. Learning from built-in views
      5m 52s
    3. Creating and deleting a simple view
      5m 41s
    4. Diving into the Views interface
      8m 48s
    5. Surveying field types
      6m 16s
    6. Adjusting the settings of individual fields
      5m 31s
    7. Sorting and filtering data
      8m 11s
    8. Changing Views' administrative options
      7m 55s
  6. 33m 33s
    1. Varying how a view appears in different displays
      10m 10s
    2. Formatting views with grid, list, table, and jump menu appearances
      6m 43s
    3. Rewriting field output for interesting results
      4m 21s
    4. Creating multipart views using attachments
      6m 8s
    5. Styling the output of views
      6m 11s
  7. 33m 56s
    1. Importing and exporting views
      6m 21s
    2. Controlling access to data
      6m 44s
    3. Adding dynamic filters to views
      5m 41s
    4. Extending views with relationships
      6m 24s
    5. Improving data administration with Views Bulk Operations
      8m 46s
  8. 29m 43s
    1. Understanding locational data
      4m 43s
    2. Setting up the Location module
      9m 42s
    3. Displaying basic maps with the GMap module
      8m 37s
    4. Displaying custom maps
      6m 41s
  9. 23m 50s
    1. Exporting data in simple text form
      7m 4s
    2. Adding dates and calendars
      8m 32s
    3. Displaying content in a slideshow
      8m 14s
  10. 1m 20s
    1. Next steps
      1m 20s

Start learning today

Get unlimited access to all courses for just $25/month.

Become a member
Sometimes @lynda teaches me how to use a program and sometimes Lynda.com changes my life forever. @JosefShutter
@lynda lynda.com is an absolute life saver when it comes to learning todays software. Definitely recommend it! #higherlearning @Michael_Caraway
@lynda The best thing online! Your database of courses is great! To the mark and very helpful. Thanks! @ru22more
Got to create something yesterday I never thought I could do. #thanks @lynda @Ngventurella
I really do love @lynda as a learning platform. Never stop learning and developing, it’s probably our greatest gift as a species! @soundslikedavid
@lynda just subscribed to lynda.com all I can say its brilliant join now trust me @ButchSamurai
@lynda is an awesome resource. The membership is priceless if you take advantage of it. @diabetic_techie
One of the best decision I made this year. Buy a 1yr subscription to @lynda @cybercaptive
guys lynda.com (@lynda) is the best. So far I’ve learned Java, principles of OO programming, and now learning about MS project @lucasmitchell
Signed back up to @lynda dot com. I’ve missed it!! Proper geeking out right now! #timetolearn #geek @JayGodbold
Share a link to this course

What are exercise files?

Exercise files are the same files the author uses in the course. Save time by downloading the author's files instead of setting up your own files, and learn by following along with the instructor.

Can I take this course without the exercise files?

Yes! If you decide you would like the exercise files later, you can upgrade to a premium account any time.

Become a member Download sample files See plans and pricing

Please wait... please wait ...
Upgrade to get access to exercise files.

Exercise files video

How to use exercise files.

Learn by watching, listening, and doing, Exercise files are the same files the author uses in the course, so you can download them and follow along Premium memberships include access to all exercise files in the library.


Exercise files

Exercise files video

How to use exercise files.

For additional information on downloading and using exercise files, watch our instructional video or read the instructions in the FAQ.

This course includes free exercise files, so you can practice while you watch the course. To access all the exercise files in our library, become a Premium Member.

Join now "Already a member? Log in

Are you sure you want to mark all the videos in this course as unwatched?

This will not affect your course history, your reports, or your certificates of completion for this course.


Mark all as unwatched Cancel

Congratulations

You have completed Drupal 7: Reporting and Visualizing Data.

Return to your organization's learning portal to continue training, or close this page.


OK
Become a member to add this course to a playlist

Join today and get unlimited access to the entire library of video courses—and create as many playlists as you like.

Get started

Already a member?

Become a member to like this course.

Join today and get unlimited access to the entire library of video courses.

Get started

Already a member?

Exercise files

Learn by watching, listening, and doing! Exercise files are the same files the author uses in the course, so you can download them and follow along. Exercise files are available with all Premium memberships. Learn more

Get started

Already a Premium member?

Exercise files video

How to use exercise files.

Ask a question

Thanks for contacting us.
You’ll hear from our Customer Service team within 24 hours.

Please enter the text shown below:

The classic layout automatically defaults to the latest Flash Player.

To choose a different player, hold the cursor over your name at the top right of any lynda.com page and choose Site preferencesfrom the dropdown menu.

Continue to classic layout Stay on new layout
Exercise files

Access exercise files from a button right under the course name.

Mark videos as unwatched

Remove icons showing you already watched videos if you want to start over.

Control your viewing experience

Make the video wide, narrow, full-screen, or pop the player out of the page into its own window.

Interactive transcripts

Click on text in the transcript to jump to that spot in the video. As the video plays, the relevant spot in the transcript will be highlighted.

Are you sure you want to delete this note?

No

Your file was successfully uploaded.

Thanks for signing up.

We’ll send you a confirmation email shortly.


Sign up and receive emails about lynda.com and our online training library:

Here’s our privacy policy with more details about how we handle your information.

Keep up with news, tips, and latest courses with emails from lynda.com.

Sign up and receive emails about lynda.com and our online training library:

Here’s our privacy policy with more details about how we handle your information.

   
submit Lightbox submit clicked
Terms and conditions of use

We've updated our terms and conditions (now called terms of service).Go
Review and accept our updated terms of service.