Drupal 7 Module Development

Drupal Permissions and Security
In this chapter, we will cover the following:
• Drupal's roles and permissions concepts
• Using user_access() to assert permissions
• Using hook_permission()
• Access control with hook_menu()
• Common errors in defining permissions
• Declaring your own access functions
• Securing sensitive actions with permissions
• Responding when access is denied
• Enabling permissions programmatically
• Permissions, security, and Drupal forms
• Security considerations for AJAX processing
Using user_access() to assert
permissions
The user_access() function is the primary security element in the Drupal API.
Most page requests pass through the function, as do many administrative functions
and the display of certain page elements. Pages, blocks, fields, and form elements
are some of the items that can be shown or hidden by wrapping their display in a
user_access() call.
The function is quite elementary, taking only two arguments:
user_access($string, $account = NULL)
Here, $string is the machine readable name of the permission, and $account is an
optional copy of a $user object, as returned by the function user_load().
The following is a typical access check, taken from the Menu module:
$form['menu'] = array(
'#type' => 'fieldset',
'#title' => t('Menu settings'),
'#access' => user_access('administer menu'),
'#collapsible' => TRUE,
'#collapsed' => !$link['link_title'],
);
[ 212 ]