Drupal 7 Module Development

Chapter 8
Running access checks on forms
While it is perfectly fine to run access checks when building a form, developers
should normally not run access checks when processing a form's _validate() or
_submit() callbacks. Doing so interferes with the logic of hook_form_alter().
For instance, if your module wishes to alter the menu form element above, so that
additional users may add content items to the menu without being able to edit the
entire menu, you can do so easily:
function example_form_alter(&$form, $form_state, $form_id) {
if (!empty($form['#node_edit_form']) && isset($form['menu'])) {
$form['menu']['#access'] = example_user_access(
'assign content to menu');
}
}
This code changes the access callback on the menu form element to our own function.
Since hook_form_alter() runs after a form is initially built, we can alter any form
element in this manner.
However, form _validate() and _submit() callbacks are not run through any alter
functions. This means that any access checks that run during those callbacks will
always be imposed. Take for instance, the following example from Drupal's core
node.module, that makes it impossible for normal users to change the author of a
node or the time it was submitted:
/**
* Perform validation checks on the given node.
*/
function node_validate($node, $form = array()) {
$type = node_type_get_type($node);
if (isset($node->nid) && (node_last_changed($node->nid) >
$node->changed)) {
form_set_error('changed', t('The content on this page has
either been modified by another user, or you have already submitted
modifications using this form. As a result, your changes cannot be
saved.'));
}
if (user_access('administer nodes')) {
// Validate the "authored by" field.
if (!empty($node->name) && !($account = user_load_by_name(
$node->name))) {
// The use of empty() is mandatory in the context of usernames
[ 233 ]