Drupal 7 Module Development

Drupal Permissions and Security
The form is additionally tagged with a $form['#token'] element during
drupal_process_form(). The #token is used to ensure that a form request came
from a known request (that is, an HTTP request that has been issued a valid session
for the site). The #token value is set with drupal_get_token():
function drupal_get_token($value = '') {
return drupal_hmac_base64($value, session_id().
drupal_get_private_key(). drupal_get_hash_salt());
}
When Drupal processes a form, both the $form_build_id and $form['#token']
values are validated to ensure that the form request originated from the Drupal site.
We should also note that Drupal forms default to using the POST
method. While it is possible to submit Drupal forms via GET, developers
are always encouraged to use POST, which is more secure. We will look
at securing GET requests when we discuss AJAX handling a little later in
this chapter.
Disabling form elements
In addition to the global security of a specific form, you may also wish to enable or
disable specific parts of a form, either your own module's form or that provided by
Drupal core (or another contributed module). In the first example of this chapter,
we saw how this can be done using the user_access() function (or a similar access
control function) to mark an individual form element or entire section of a form
as inaccessible.
$form['menu'] = array(
'#type' => 'fieldset',
'#title' => t('Menu settings'),
'#access' => user_access('administer menu'),
'#collapsible' => TRUE,
'#collapsed' => !$link['link_title'],
);
When the content editing form is rendered, users without the administer menu
permission will not see this element of the form.
Note that '#access' => FALSE is not the same as
'#disabled' => FALSE in Drupal's Forms API. Using
#disabled => FALSE will render the form element and disable
data entry to that element, while '#access' => FALSE removes
the element entirely from the output.
[ 230 ]