Drupal 7 Module Development

Chapter 8
This allows us to pass a Drupal authentication token to our access callback. To make
this work, we modify our link creation code to include a token:
if ($user->uid > 0) {
$output = l(t('Add to my list'), 'example-ajax/'. $item->id .
'/add/'. $user->uid) .'/'. drupal_get_token($user->uid);
return $output;
}
This will generate a link similar to:
Add to my list
Then, in our access callback, we check the token string in addition to the user:
function example_access_ajax_add($account, $token = NULL) {
global $user;
// Check the validity of the user account.
if ($account->uid == 0 || $account->uid != $user->uid) {
return FALSE;
}
// Check the validity of the callback token.
if (empty($token) || !drupal_valid_token($token, $account->uid)) {
return FALSE;
}
return TRUE;
}
Drupal's token handling API performs the validation for us, and we are ensured the
same protection that is given to regular Drupal forms.
Note that this approach will only work correctly for logged-in users
who are being served non-cached pages. The link we output to access
this callback cannot be cached, since caching returns the same HTML
output to all users.
As a general rule, you only need to worry about token handling for AJAX callbacks
that perform creative or destructive actions, such as editing a list of user favorites.
That is because such actions generally write to the database, and can change certain
settings for your Drupal users. Simple AJAX callbacks that only read and return data
do not necessarily need to be secured in this manner unless the data is user-specific.
[ 239 ]