Drupal 7 Module Development

Chapter 8
As a result, we cannot trust the menu callback to fire any action in
example_ajax_add() without adding some additional security checks.
First, we know that we need to check the user performing the action. From our
earlier discussion, this is best handed through an access callback, so we edit
our declaration:
'access callback' => 'example_access_ajax_add',
To run this check successfully, we also need to know the $user whose list is
being updated:
$items['example-ajax/%item/add/%user'] = array(
We also need to pass the $user to our access callback:
'access arguments' => array(3),
So our rewritten hook looks like the following code:
function example_menu() {
$items = array();
$items['example-ajax/%item/add/%user'] = array(
'title' => 'Example AJAX add to list',
'page callback' => 'example_ajax_add',
'page arguments' => array(1, 3),
'access callback' => 'example_access_ajax_add',
'access arguments' => array(3),
'type' => MENU_CALLBACK,
);
return $items;
}
In our access callback, we can now check that the link references the current user. So
our HTML code will look something like the following:
Add to my list
The code to generate this link would run through Drupal's l() function:
if ($user->uid > 0) {
$output = l(t('Add to my list'), 'example-ajax/'. $item->id .'/
add/'. $user->uid);
return $output;
}
[ 237 ]