2

I have a front-end form that registered users can log into and edit entries.

I am checking for the correct user group, then also checking for the permission:

{% if currentUser.isInGroup('myGroup') %}

    {# Get the entry #}
    {% set request = craft.app.request.segment(3) %}
    {% set entry = craft.entries.section('mySection').slug(request).one() %}

    {% if entry|length > 0 %}
        {% if currentUser.can('editEntries:7') %}
          {# user can edit the current entry #}
        {% endif %}
    {% endif %}

{% endif %}

All is fine, but if I change the url to another valid url (where the logged in user is not the author) I am still able to see the entry.

Is there a way to prevent that? Is it as easy as just checking/comparing authors? Or is there a more eloquent way? I do have other permissions disabled... enter image description here

Thank you for any suggestions!

2

You can check if the current entry's author is the currentUser.

{% if entry.author.id == currentUser.id %}
    {# User can edit entry #}
{% endif %}
  • Thank you! It turned out, I needed to enable the other options, and check if the user was related to another entry to verify the ability to edit/delete. – Damon Oct 30 '18 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.