Check user is in User Group / Custom User Permissions

Question

I'm trying to restrict access to items in a channel using some form of custom user permissions however I don't appear to be able to create or set custom read permissions for a channel using crafts permissions as they currently are, I'm therefore trying to do something using either user groups or custom fields on the user and validate if a user has access that way.

I'm hoping this is along the right lines, although it doesn't seem ideal, so is it possible to check if a user is in a certain user group elegantly using twig?

I can do {{ if currentUser.admin }} and I'm guessing I could therefore do something like {{if 'groupnamewithaccess' in currentUser.groups }}

score 26 · Accepted Answer · answered Jul 14 '14 at 21:53

26

I believe what you're looking for is 'isInGroup'

{% if currentUser.isInGroup('groupHandle') %}

It will also accept an actual group object or a group ID as well.

There is also getGroups:

{{ currentUser.getGroups() }}

Will return an array of UserGroupModels all of the groups the user belongs to.

And finally, can:

{{ currentUser.can('permissionName') }}

Will check if the current user has the given permissions, whether that was indirectly assigned to them in a group, or directly assigned to them as a user.

answered Jul 14 '14 at 21:53

Brad Bell

67,440
6
73
143

This is perfect, isInGroup works perfectly. – Darren Jul 20 '14 at 00:34
Any chance that we can get something like this to work? Sometimes I just need to make sure that a user is NOT a member of a group. Right now I don't see a simple way to make this determination.
{% if !currentUser.isInGroup('groupHandle') %}
– David A McInnis Sep 23 '14 at 22:48
2

@DavidAaronMcInnis Use {% if not currentUser.isInGroup('groupHandle') %} – Brad Bell Sep 24 '14 at 03:14
Can isInGroup be accessed from within a plugin? – David A McInnis Feb 17 '15 at 19:07
@DavidAaronMcInnis craft()->userGroups->getGroupsByUserId($user->id) – Elliot Cameron Apr 25 '17 at 04:29
I presume this is only about viewing the actual page for the entry rather than being able to restrict edit/creation by a user group? – Matt Fletcher Apr 15 '19 at 11:17
You can also do currentUser.isInGroup(['groupHandle1','groupHandle2']) for an OR, which is pretty neat. – iamkeir Nov 06 '19 at 14:38

score 11 · Answer 2 · edited Feb 23 '19 at 18:34

If you're looking to check groups and/or permissions from your plugin controller with PHP, you can access the same methods.

Craft 3.0.x:

//get the current user from craft
$user = Craft::$app->getUser();

//check if the current user has permission to edit certain entries
$user->getIdentity()->can('editEntries: 27')

//check if user is in group
$user->getIdentity()->isInGroup('specialGroupHandle'));

Craft 3.1.x

Since Craft 3.1.x not uses ids to check permissions anymore but uids you need to pass the uid of your section

$user->getIdentity()->can('editEntries: 86f6afac-1d8c-43ba-8624-12d925ba57f5')

Craft 2:

//get the current user from craft
$user = craft()->userSession->getUser();

//check if the current user has permission to edit certain entries
$checkPerms = $user->can('editEntries: 27');

$checkPerms will return a boolean

Just a note that it's probably more clear that "get the current user" should be $user = Craft::$app->getUser()->getIdentity(); as Craft::$app->getUser() technically returns the User service/component (as noted by Robin here: https://craftcms.stackexchange.com/a/25917/6275). — Nate Beaty, May 06 '22 at 21:40

score 2 · Answer 3 · answered Nov 01 '19 at 10:50

I had a similar situation:
I wanted to restrict some users from certain entries.

I've created a checkboxes field called "cf_userRights_checkboxes" where the label is the user-groups name and the value is the user-groups id. Then added that field to a section.

In a section entry you will be able to set the user-groups that have permission and then check if the currentUser is in one of these groups:

{% set condition = 0 %}
{% for userGroup in currentUser.getGroups %}
    {% if userGroup.id in entry.cf_userRights_checkboxes %}
        {% set condition = 1 %}
    {% endif %}
{% endfor %}

{% if condition %}
    please enter
{% else %}
    sorry, not you
{% endif %}

Note: you have to loop through user-groups because a user can be in more than one group.

Let me know if there's a better solution.

Cheers
Stefan

score 1 · Answer 4 · answered Jan 24 '21 at 10:22

Like in answer before of Robin Schambach and David Rampersad I tried to solved it this way:

$user->getIdentity()->can('editEntries: 86f6afac-1d8c-43ba-8624-12d925ba57f5')

Anyway I had to remove the space between the uuid and the permission string:

$user->getIdentity()->can('editEntries:86f6afac-1d8c-43ba-8624-12d925ba57f5')

Inside my module I ended up with that:

$user->checkPermission('editEntries:'.$entry->section->uid)

Check user is in User Group / Custom User Permissions

4 Answers4

Linked