Drupal 7 Module Development

Chapter 8
The preceding code checks if the user editing a page may add a link to that page in
the site's navigation menu. The permission administer menu indicates that the user's
role is trusted enough to make structural changes to the site (for instance, like adding
a link to this content on the Main menu, which appears on every page). The
user_access() function returns a Boolean value, namely, if TRUE, the user may
perform the requested action; if FALSE, the user may not. In the case of this form
code, the form element will only be displayed if the access check returns TRUE.
Otherwise, the form's default value will be retained.
Note that the preceding example does not pass an $account object. As a result, the
user_access() function defaults to using the current $user object, that is, the user
currently making the page request. The $user object is stored in a global variable,
and so it can be accessed any time a specific $account is not specified.
You are not required to specify an $account when calling user_access(), and in
most cases this is fine, but there are use cases where you might want to check the
permission against a user other than the current logged-in $user.
Checking the proper user account
In most cases, permission checks are made against the current user, defined in the
$user object. Module authors must pay careful attention to the context of their
permission checks, especially when displaying information about specific users.
For example, you may wish to add a section to the user account page where a site
administrator can check the roles that an individual user has. To do this we would
implement hook_user_view() and test the global $user object to ensure that this is
a trusted administrator, who can view this information.
First, we set up a simple check for the current user: Does he/she have the permission
to view this information?
function example_user_view($account, $view_mode) {
if (!user_access('view user roles')) {
return;
}
}
You will see this pattern frequently in Drupal code. Failing the access check leads
to a return out of the function and makes the code easier to follow. Since we are
only adding information to an existing page, returning no data is fine. (Later in the
chapter, we will look at other ways to deal with denied permissions.)
[ 213 ]