Drupal 7 Module Development

Drupal Permissions and Security
function example_user_page($account) {
global $user;
if ($user->uid != $account->uid) {
return MENU_ACCESS_DENIED;
}
// ...
There is a subtle yet important difference between the two approaches. If we use
a menu callback to assert access control, the tab link will only be rendered if the
user passes the access check. If we use an access check within the page callback, the
tab will always be rendered. It is poor usability to present a tab that only prints an
'access denied' message to the user. For this reason, page-level access checks should
almost always be handled by hook_menu().
Should I use drupal_access_denied() or a custom page?
drupal_access_denied() returns a version of the traditional Apache
403 access denied page, served by Drupal. Good usability suggests that
providing a friendlier error message page helps users navigate your site
with ease. If you support this idea, feel free to create a custom 403 page.
Drupal allows you to assign any content page as the 403 message page.
The drupal_access_denied() function returns the output of that
page, so there is no need to code a custom 403 message into your module
since one can be created and edited through the normal Drupal content
interface.
The settings for your 403 and 404 page are found under the Site Information settings.
[ 226 ]