Drupal 7 Module Development

Node Access
This clause is primarily a query builder function, designed to create the proper join
from the {node} table to the {node_access} table and then return the result of that
query. Understanding how that query is constructed – and how the {node_access}
table is populated – is the key to understanding Node Access.
Dealing with unpublished content
For experienced module authors, one major difference between Drupal
7 and previous versions is that hook_node_grants() is now invoked
for unpublished content. Great care must be taken to prevent exposing
unpublished content to users.
If the Node Access API does not assert rules, this clause will default to allowing
access to content. But notice that the function does not end here.
elseif (is_object($node) && $op == 'view' && $node->status) {
// If no modules implement hook_node_grants(), the default
// behavior is to allow all users to view published nodes,
// so reflect that here.
$rights[$account->uid][$cid][$op] = TRUE;
return TRUE;
}
}
}
return FALSE;
At the very end of the function, notice the final return FALSE; statement. From a
security standpoint, this catch-all ensures that we never grant access by accident.
Whenever writing an access check, FALSE should be your default return.
hook_node_access() compared to
{node_access}
For module developers, the two key points to the node_access() function
are the behaviors of the two hook invocations: hook_node_access() and
hook_node_grants(). Because of the fundamental difference between how
the two hooks are implemented, for the rest of the chapter, we will refer to a node
access module as one that implements hook_node_grants() and writes to the
{node_access} table. A module that implements hook_node_access() will be
referred to as an access control module.
[ 250 ]