<p>This can be achieved using the <a href="https://craftcms.com/docs/plugins/events-reference#elements-onBeforeBuildElementsQuery" rel="nofollow">onBeforeBuildElementsQuery</a> event: </p>

<pre><code>craft()-&gt;on('elements.onBeforeBuildElementsQuery', function(Event $event) {
   // $event-&gt;params['criteria']['tennant'] = 'new-york';
});
</code></pre>

<p>With some smarts around group permissions:</p>

<pre><code>public function registerUserPermissions()
{
    return array(
        'tennants' =&gt; array('label' =&gt; Craft::t('Tennants'), 'nested' =&gt; array(
            'newcastle' =&gt;  array('label' =&gt;  Craft::t('Newcastle')),
            'gosford' =&gt;  array('label' =&gt;  Craft::t('Gosford')),
        ))
    );
}
</code></pre>

<p>a custom plugin for this functionality should be possible.</p>

CC BY-SA 3.0
2016-04-13T05:13:40.370Z
2016-04-13T05:13:40.370Z
Leevi Graham
<p>So you could definitely use the onBeforeBuildElementQuery event to keep them from showing up in the CP (though you'd have to detect if the query is coming from the CP).</p>

<p>I'd also recommend your plugin uses the onBeforeSaveElement event. From there you could check the element's related categories to see if the user has them on their user account, and then allow/deny them to be able to save the element from there. While hiding it from the CP would likely keep them from finding it, putting in more validation will make sure that no one emails an edit link to someone who isn't supposed to be able to edit it.</p>

CC BY-SA 3.0
2016-04-12T23:04:48.330Z
Yeah there would need to be lots of other checks… CP, user group, entry type etc. onBeforeBuildElementsQuery is the hook I'm after. Adding modifyEntrySources would also enhance the interface for those content managers who are assigned to multiple cities.
Leevi Graham
CC BY-SA 3.0
2016-04-12T23:11:41.207Z
Are you thinking of this for client work or as a workflow plugin? Would love to see some sort of one-size-fits-most of the latter.
Patrick Harrington
CC BY-SA 3.0
2016-04-12T23:21:09.390Z
It's for a couple of clients actually. Multiple publishing groups publishing into topics. One case it's city based, another it's a school group publishing news into each school. In both cases there is some kind of tenancy.
Leevi Graham
CC BY-SA 3.0
2016-04-12T22:50:32.153Z
2016-04-12T22:50:32.153Z
Patrick Harrington
<p>How can I implement security which allows members to only publish an entry in an assigned category / topic?</p>

<p>Example:</p>

<ul>
<li>The site is a business directory.</li>
<li>Business listings are published in cities: New York, California.</li>
<li>Content managers are assigned to either New York or California.</li>
<li>Content managers can only publish in the city they are assigned to.</li>
<li>Content managers can only see entries in the city they are assigned to.</li>
</ul>

<p>I first thought this could be done with a custom field that only shows the cities a content manager is assigned to. That shouldn't be so hard.</p>

<p>However I'd need to also limit the entry indexes in the Control Panel. </p>

<p>Edit: Just found the onBeforeBuildElementsQuery event: <a href="https://craftcms.com/docs/plugins/events-reference#elements-onBeforeBuildElementsQuery" rel="nofollow">https://craftcms.com/docs/plugins/events-reference#elements-onBeforeBuildElementsQuery</a></p>

<pre><code>    craft()-&gt;on('elements.onBeforeBuildElementsQuery', function(Event $event) {
       // $event-&gt;params['criteria']['tennant'] = 'new-york';
    });
</code></pre>

<p>Any ideas?</p>

<control-panel><security>
Restrict entry editing to category / topic
# Restrict entry editing to category / topic

(Asked by: username_0 on 2016-04-12)

How can I implement security which allows members to only publish an entry in an assigned category / topic?
Example:

The site is a business directory.
Business listings are published in cities: New York, California.
Content managers are assigned to either New York or California.
Content managers can only publish in the city they are assigned to.
Content managers can only see entries in the city they are assigned to.

I first thought this could be done with a custom field that only shows the cities a content manager is assigned to. That shouldn't be so hard.
However I'd need to also limit the entry indexes in the Control Panel. 
Edit: Just found the onBeforeBuildElementsQuery event: https://craftcms.com/docs/plugins/events-reference#elements-onBeforeBuildElementsQuery
    craft()->on('elements.onBeforeBuildElementsQuery', function(Event $event) {
       // $event->params['criteria']['tennant'] = 'new-york';
    });

Any ideas?

**Tags:** control-panel, security

---

## 2 answers

### Answer by username_0 on 2016-04-13. Score: 2 | Accepted answer

This can be achieved using the onBeforeBuildElementsQuery event: 
craft()->on('elements.onBeforeBuildElementsQuery', function(Event $event) {
   // $event->params['criteria']['tennant'] = 'new-york';
});

With some smarts around group permissions:
public function registerUserPermissions()
{
    return array(
        'tennants' => array('label' => Craft::t('Tennants'), 'nested' => array(
            'newcastle' =>  array('label' =>  Craft::t('Newcastle')),
            'gosford' =>  array('label' =>  Craft::t('Gosford')),
        ))
    );
}

a custom plugin for this functionality should be possible.


---

### Answer by username_1 on 2016-04-12. Score: 2

So you could definitely use the onBeforeBuildElementQuery event to keep them from showing up in the CP (though you'd have to detect if the query is coming from the CP).

I'd also recommend your plugin uses the onBeforeSaveElement event. From there you could check the element's related categories to see if the user has them on their user account, and then allow/deny them to be able to save the element from there. While hiding it from the CP would likely keep them from finding it, putting in more validation will make sure that no one emails an edit link to someone who isn't supposed to be able to edit it.

> **Comments:**
> **username_0**: Yeah there would need to be lots of other checks… CP, user group, entry type etc. onBeforeBuildElementsQuery is the hook I'm after. Adding modifyEntrySources would also enhance the interface for those content managers who are assigned to multiple cities.  
> **username_1**: Are you thinking of this for client work or as a workflow plugin? Would love to see some sort of one-size-fits-most of the latter.  
> **username_0**: It's for a couple of clients actually. Multiple publishing groups publishing into topics. One case it's city based, another it's a school group publishing news into each school. In both cases there is some kind of tenancy.  

---

