Drupal 7 Module Development

Chapter 9
if (!user_access('access content', $account)) {
$rights[$account->uid][$cid][$op] = FALSE;
return FALSE;
}
The first if clause ensures that we have a proper $account for the check.
Remember that even anonymous users generate a valid $account object
and may have assigned permissions.
The second clause enforces the static cache. This is a performance optimization new
to Drupal 7.
The third is a user_access() check new to Drupal 7 and allows super-users to pass
all node access checks and perform all operations on all nodes. This permission was
split off from the administer nodes permission of prior versions in order to more
clearly indicate how node access functions. It has the added benefit of allowing more
granular permissions.
The last is another user_access() check. It simply checks that a user may
access content on the site. If not, then the user is always denied access to
all node operations.
Invoking hook_node_access()
To this point, the code is fairly obvious and the intentions are clear: Drupal is
running basic security checks against known values. At this point, the core node
module begins querying other modules about the access status of the node. The next
piece invokes hook_node_access() to check for access rules:
// We grant access to the node if both of the following conditions
// are met:
// - No modules say to deny access.
// - At least one module says to grant access.
// If no module specified either allow or deny, we fall back to the
// node_access table.
$access = module_invoke_all('node_access', $node, $op, $account);
if (in_array(NODE_ACCESS_DENY, $access, TRUE)) {
$rights[$account->uid][$cid][$op] = FALSE;
return FALSE;
}
elseif (in_array(NODE_ACCESS_ALLOW, $access, TRUE)) {
$rights[$account->uid][$cid][$op] = TRUE;
return TRUE;
}
[ 247 ]