Drupal 7 Module Development

Drupal Permissions and Security
Summary
Our coverage of Drupal's permission system should give you all the information you
need to properly set the access rules for your module.
In this chapter, we have learned the basics of the permission and role system in
Drupal. We have also seen how to use user_access() to assert permissions. We
have discussed how hook_menu() handles access control, and also how to use
hook_permission().
We have seen the importance of granular permission definitions, and when to use a
function other than user_access() to assert permission control. We discussed how
to write a custom access control function, and how to respond when access is denied.
We also saw how to assign and remove permissions using hook_enable() and
hook_disable().
We learnt how to manage roles programmatically along with the basics of securing
Drupal forms. Lastly we looked at how to safely handle AJAX callbacks.
[ 240 ]