When you configure a contextual filter, there is an option to not include the default argument when constructing the URL for the view:
 Skip default argument for view URL

What do you think about providing an option here for skipping a non-default argument as well? There are some use cases, when this can also be useful, e.g. the argument doesn't always come from the URL, and including it after e.g. submitting exposed filters doesn't make sense.

I have created two mockups:

Version A

The second checkbox would be visible only if the first one is checked. Of course we need better descriptions.

 Skipping non-default arguments for views URL

Version B

A new fieldset like this, it could be collapsed by default.

 Skipping non-default arguments for views URL

I am curious about your opinion, and if you think it's a good idea, I would be happy to work on this patch.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

balintk’s picture

Title: Skipping non-default arguments for views URL » Skipping non-default arguments for view URL

Small correction in the title.

balintk’s picture

Component: Views Form » User interface
Status: Active » Needs review
FileSize
5.28 KB

We have talked with dereine, and he supports the version A. So I implemented that, here is the patch, which definitely needs testing.

tim.plunkett’s picture

Status: Needs review » Needs work

Just some minor code nitpicks, approach seems fine.

+++ b/handlers/views_handler_argument.incundefined
@@ -104,6 +104,9 @@ class views_handler_argument extends views_handler {
+      $this->options['argument_skip_url'] = 1;

I think this should really be TRUE, we can clean up the rest of the code later, but it's really a Boolean

+++ b/handlers/views_handler_argument.incundefined
@@ -183,6 +186,7 @@ class views_handler_argument extends views_handler {
+    $options['argument_skip_url'] = array('default' => FALSE);

add , 'bool' => TRUE after the default part

+++ b/handlers/views_handler_argument.incundefined
@@ -462,11 +466,15 @@ class views_handler_argument extends views_handler {
+      $options['default_argument_skip_url'] = 0;

FALSE instead of 0

+++ b/handlers/views_handler_argument.incundefined
@@ -531,11 +539,19 @@ class views_handler_argument extends views_handler {
+      '#dependency' => array('edit-options-argument-skip-url' => array('1')),

TRUE instead of '1'

zifiniti’s picture

I need to make use of this patch for some work, so I'm attaching the updated patch (per tim.plunkett's suggested amendments).

den33775’s picture

Category: feature » bug

Great idea. Implemented patch. I need it as I use the Contextual Filter to ensure that people can only see work that they have authored. But of course, any user can simply put another author's ID as a "/" on end of URL and view other people's work.

So I'm using it for security.

But when I tick both boxes, I thought it should ignore the value passed by URL and only ever use the default value?

Doesn't seem to be doing this. Still allows anyone to view anyone's content simply by adding to end of URL still.

Am I missing something or did the patch not work?

Many thanks

dawehner’s picture

Category: bug » feature

@den33775
So what you want is to use a proper argument validator, which takes care that the uid is only valid when certain criterias match.

den33775’s picture

Sort of. I want to be able to either provide the input from the URL 'or' provide the input from the provided default argument 'or' provide a default argument if argument not present in URL (the current and only option without this patch. :)

den33775’s picture

Reason being, I want to stop people over-riding my default argument by entering another one in the URL (for my current requirement). I have managed to implement this with a user/author field check, but in principle your patch would be a more flexible way of achieving the same thing. My use of context is a Relationship of "Content: Author" (required) and a contextual filter of "Content: Author UID" with "WHEN THE FILTER VALUE IS NOT IN THE URL", "Provide default value" - "User ID from logged in user", so without an argument in the URL, only content authored by the currently logged in user is listed. But simply by adding another users' ID on the end of the URL, one user can see another users' content, since the URL argument over-rides the default one.

I needed to disable the over-riding of the default argument by the argument provided in the URL.

For now, I've achieved the same thing by adding a 'Filter Criteria' filter of User: Current (relationship=author), (Is the logged in user: Yes).

So this solution works for checking a logged in user, but it doesn't give a generic solution to the problem of overriding a default argument with URL arguments (i.e. if used as I am using it, a security vulnerability). If you see what I mean?

So you can see why I felt your patch was an important and useful one. :)

Best wishes

bobodrone’s picture

Recreated the patch to work with Views 3.7

bobodrone’s picture

Issue summary: View changes

Additional comment on version B.