Drupal 7 Module Development

Drupal Permissions and Security
Responding when access is denied
In a significant change from earlier Drupal, the drupal_access_denied() function
should no longer be called when returning a normal page context.
• Page callback functions wanting to report an access denied message should
return MENU_ACCESS_DENIED instead of calling drupal_access_denied()
• However, functions that are invoked in contexts where that return value
might not bubble up to menu_execute_active_handler() should call
drupal_access_denied(). For more details see:
http://api.drupal.org/api/function/drupal_access_denied/7
However, what does this mean in practice?
One advantage of using a menu callback is that if access is denied for the page
request, Drupal automatically handles the response by running the traditional
drupal_access_denied() function.
However, the Drupal 7 rendering engine respects more contexts than the traditional
web page. Your callback function might return a JSON object, a file, or be responding
as a part of a larger page (such as a form). For example, consider the following
snippet of code from contact_site_form():
// Check if flood control has been activated for sending e-mails.
$limit = variable_get('contact_threshold_limit', 5);
$window = variable_get('contact_threshold_window', 3600);
[ 224 ]