Drupal 7 Field Permissions Module

By shane
Fri, 2012-11-30 21:52
Daily Dose of Drupal Episode #58

Share with Others

The Drupal 7 Field Permissions module can be used to customize the view and edit permissions on individual Drupal 7 fields. It is a very flexible permissions management system that gives the Drupal site builder fine grained permissions control allowing you to give certain users access view/edit fields while not allowing other users. It is based on the Drupal 7 roles system for allowing the setting of the field permissions to specific user groups (roles).

In this episode you will learn:

  • How the Drupal 7 Field Permissions module can be used to set custom permissions on a Drupal 7 field attached to a content type
  • How the Drupal 7 Field Permissions module can be used to grant field view access
  • How the Drupal 7 Field Permissions module can be used to grant field edit access

Welcome to another Daily Dose of Drupal, this is Episode Number 58. As always; I’m Shane, you can follow me on Twitter @smthomas3, you can also find me on Google + and you can also check out the newsletter on codekarate.com.

Today we’re going to be talking about the Field Permissions Module. This is very useful in a lot of situations especially if you’re building a larger Drupal 7 site or even Drupal 6 of course that is permissions based and you need to control permissions for a specific fields.

An example would be if you have a content type or user object that has a field on it and maybe you only want administrators to see and be able to edit that field. Maybe there’s specific roles on your Drupal site and certain roles can edit certain fields while others cannot.

So this module is going to allow you to be able to do that, as you can see it gives you the ability to create your own value, edit own value, edit anyone’s value, view your own value and view anyone’s value for each field.

So we’re going to go ahead and get started by downloading it and we will go ahead and enable it using Drush … I kind of spell it right the second time, now it worked, we’re going to hop over to our test site, I’ll hop into the modules page just to show you that it is in fact installed, there it is, you can set the permissions which will pop that open and we’ll look at that here, you can see just administer field permissions and you can access other users private fields, you can also configure this module and this just allow you to view all the fields that are on the site where it’s use and some of the different permissions for that field.

So let’s go ahead and as example build a simple content type and we’re just going to keep it simple, go ahead and save it. I’m going to add to this content type, the first one is going to be a public field and we’ll just make it a text field, save that, go ahead and hit save and go on, here you can see field visibility and permissions.
We’ll leave this one public, we will also add a field for private field and make that a text field again, this time though we will of course select but we want this to be a private field. It says only author and administrators can view and edit. So as you can see we have our public field and we may have a private field.

Now if we come back into the field permissions configuration page you’ll notice that those extra fields of course show up, one show up as a private field and one shows up as the public field. So let’s go ahead and go to the regular permissions page; go here and I will just refresh this page and we’re going to go to the various roles on this site. In this case there’s just authenticated user administrator and then anonymous user.

When we come back here there will be a permission for this new content type for us to be able to allow authenticated users to create new test content. We’ll allow then to create it, edit their own and delete their own. So we’re just allowing authenticated users to be able to go ahead and create that content type that we set up.

The next step is to go ahead and find a user, I’ll have to add a new one here, let’s call this user test and we’re just going to leave them authenticated user for now, we’ll create a new account and before we go ahead and create that test content we’re going to go back into our content type page and go to manage fields on our test content type and under the private field I’m going to go back into edit and click on field settings.

Okay I just want to go back in actually to the edit section and instead of private we’re going to go ahead and do custom permissions. So private would only be for the author who created the content type and administrators can edit in View but you can also go ahead and set up custom permissions.

In this case we’ll only allow the administrator to create values or edit values but we will allow authenticated users to view anyone’s value for private field and I’ll show you what this will allow you to do. So this is just of course one example, this is flexible enough to build it out however you want and be extremely flexible with building out custom permissions for your content types or anything that can be … anything that you add fields to can be very or mean very flexible with choosing field permissions module.

So I’ll do a test 1 and add some information into the public field and private field, I will save it of course as the administrator I can see the data and public field, I can see the data in private field and I can of course change those values. If I go ahead and log out, come back to the homepage here and come into this test 1 content type that I just created, you can see that this public field shows up but the private field is not there, if I log in as my test user I will be able to see both of those, this is the public field, this is the private field, I can even go ahead and add a test content type and you can see I can add public field information but I as the authenticated user cannot add any private field data.

So in order to do that I’d have to go ahead and log out and log in as the admin user again, come back to this test 2 article you’ll see I can see the public field. I as the admin can of course go in and add private field data.

So that’s just a very quick easy example of how that can work, can be expanded to or made flexible for many different types of fields and is very very beneficial on a lot of large Drupal sites that I’ve worked on. So go ahead and give it a try, let me know if you have any questions about it and as always; thanks for watching.


What modules do you use to achieve the social media buttons at bottom of video. You have check on facebook and pop up too. How? very nice. BTW, your videos are great, just the right length. One suggestion to shorten is dispense with the downloading and drushing blah blah boring and adds nothing to the instructive value of your video. Just my nickel advice. ONe other thing as I write this comment I see the Tao image screened back, nice touch, how?

In episode #46, you were discussing building a membership website and adding membership info to the User entities with the Profile2 module. I'm doing that for a site right now. The Field Permissions module can extend the Profile2 module in many useful ways.

For example, I've added a membership number field to a profile, so members can see their own and each others' membership number, but only users with role Membership Admin can change it.

Also, the club that I'm building the site for sends out a magazine, so they need a member's mailing address. The address is included in the member's profile (actually built as a Field Collection, you might want to cover that module!), and can be edited by the member and the Membership Admins, but is otherwise not visible to anyone.

DarryIRi, you should take a look at the addressfield module as well (Addressfield).

I think it sounds like it would do everything you are currently using the field collection module for. i.e. provide all the address fields you require.

With the added benefit of getting regular updates (to region codes and countries for example) and some verification of the various sub fields like zip/post code. As well as not needing to configure the field collection in a seperate area, it can be managed from the profile field management area.

Hi Gareth! You'd be quite correct if the only contact information I needed to store was a mailing address. In fact, I am using addressfield for the postal address -- it's way better than trying to roll your own. You get correct address layout for each country and a valid list of countries and their states/provinces.

But I also need to collect one or more phone numbers and website URLs. Field Collection was a natural because I need to collect this same contact information in other parts of the site, for other uses. For example, this international club charters local clubs, so we need their contact info. And there are events, for which we need contact info also.

I'm using Entity View Mode module as well, which allows me to create multiple View Modes for Field Collections so that even though one collection is used for multiple purposes, it can be formatted differently in different contexts. (An alternative to this is using Display Suite, which is really excellent, but I felt I wouldn't need its capabilities in enough other areas to justify building it in.)

Hi shane:

How to config free tagging with field permission? Is the field permission module implement free tagging function?

Can I, with this module, during sign up, allow user to insert a value in a field and then lock the editing of this field?

Hi! thanks for this great tutorials.

This module is great, but it is does not fit my needs.

What I need is that the user (when creating a new content) assigns what roles will be able to see that field. Is there any module suited for that?

Something like

Field [ ] - Permissions: Role 1 [x] / Role 2 [x] / Role 3 [ ]


Hi Shane,

Is it possible (maybe with other module) to assing view permission to a field while creating content, so that the end user can assign the permission?

Something like:

Name : [ ] Roles: Role1 [x] Role 2 [x] Role 3 [ ]

Yea, I was searching for this on drupal official site. Couldnt find it in documentation either. Thanks for the share :)

Post new comment