Drupal 7 Module Development

Chapter 8
Declaring your own access functions
The user_access() function is a great utility function, but it cannot cover all logical
use cases. It cannot, for instance, check two access permissions at the same time. You
can, of course, write a statement such as:
if (user_access('permission one') && user_access('permission two')) {
// perform some action…
}
When securing actions within your code, this approach is perfectly fine. However,
menu-based access checks cannot be subject to such rules. In these cases, we need to
declare our own access callback within the menu item.
For instance, let's take our last module example. Suppose that instead of displaying
this information on the user profile page, we wanted to make a stand-alone page for
this information. We might make a tab on the user page, using a menu callback like
the following one:
/**
* Implement hook_menu().
*/
function example_menu() {
$items['user/%user/content'] = array(
'title' => 'Content creation',
'page callback' => 'example_user_page',
'page arguments' => array(1),
'access arguments' => array('view content creation permissions'),
'type' => MENU_LOCAL_TASK,
);
return $items;
}
This would work just fine, unless we needed to check an additional permission or
condition during the access check. Suppose our business rules say that only editors
who may also administer users may view this page.
In that case, we have a problem, because the user_access() function cannot accept
multiple permissions during a single call. In this case, we have to use the access
callback parameters of the menu $item:
/**
* Implement hook_menu().
*/
function example_menu()
example_menu() {
[ 221 ]