Drupal 7 Module Development

Drupal Permissions and Security
In our callback, the menu system transforms 10 into a standard $user object, which
we check for validity in two ways:
function example_access_ajax_add($account) {
global $user;
if (!$account->uid || $account->uid != $user->uid) {
return FALSE;
}
return TRUE;
}
First, if user_load() returns FALSE, then the page argument is invalid. Second,
if the returned $account does not match the user making the request, the request
is invalid.
This is pretty good. It allows our code to check that the user making the AJAX
request is the currently logged in user. However, how do we know that this
request came from our server and is not a CSRF attack?
Well honestly, we don't know and we can't know. However, we can be a little
paranoid and add another layer of security.
Knaddson gives us the key in Cracking Drupal, when he says:
The security team is working on an API to make [securing AJAX callback] much
easier, but that API is not yet available…The system is based on the same token
system used to protect Drupal forms.
Cracking Drupal, page 18
To implement this structure, we have to add an additional argument to our
page callback:
function example_menu() {
$items = array();
$items['example-ajax/%item/add/%user/%'] = array(
'title' => 'Example AJAX add to list',
'page callback' => 'example_ajax_add',
'page arguments' => array(1, 3),
'access callback' => 'example_access_ajax_add',
'access arguments' => array(3, 4),
'type' => MENU_CALLBACK,
);
return $items;
}
[ 238 ]