"access callback": A function returning a boolean value that determines whether the user has access rights to this menu item. Defaults to user_access() unless a value is inherited from a parent menu item..

I seem to remember that removing this feature was a security fix in the D6 branch.

  // Check for a TRUE or FALSE value.
  if (is_numeric($callback)) {
    $item['access'] = (bool)$callback;
  }

Where has that been all my life? I constantly need to give universal access to an item, and usually mess around with "function return_true { return TRUE; }". The API has to mention that access_callback will accept boolean values.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ssiruguri’s picture

Are you referring to 6.x for these issues? The code in includes/menu.inc seems to match what's documented for hook_menu for 6.x; as to the undocumented feature, that's a good catch, but the code in 6.x (v6.8, line 2341) is:

    if (is_bool($item['access callback'])) {
      $item['access callback'] = intval($item['access callback']);
    }

which is sort of the opposite of what you've pasted :)

JohnFilipstad’s picture

Project: Documentation » Drupal core
Version: » 6.x-dev
Component: Correction/Clarification » documentation

api?
moved to Drupal project, Docs component

Dave Reid’s picture

Title: hook_menu, one outdated statement, one undocumented feature. » Update the hookhook_menu, one outdated statement, one undocumented feature.
Version: 6.x-dev » 7.x-dev
Component: documentation » menu system

We'll need to fix this in the 7.x menu.api.php first, then it can be easy to backport to the 6.x docs.

Jody Lynn’s picture

Title: Update the hookhook_menu, one outdated statement, one undocumented feature. » Problems with hook_menu 'access callback' docs
Component: menu system » documentation
Category: bug » task
Issue tags: +Documentation
jhodgdon’s picture

Title: Problems with hook_menu 'access callback' docs » hook_menu 'access callback' docs should mention boolean values work too
Category: task » bug
Issue tags: -Documentation +Novice

Thanks for moving this into the correct component. It's not necessary to add a documentation tag if an issue is in the documentation component however. And it's a documentation bug, not a task.

OK, let's see here...

Looking at http://api.drupal.org/api/function/hook_menu/7 it says:

"access callback": A function returning a boolean value that determines whether the user has access rights to this menu item. Defaults to user_access() unless a value is inherited from a parent menu item.

Looking at http://api.drupal.org/api/function/_menu_check_access/7 we have:

 $callback = empty($item['access_callback']) ? 0 : trim($item['access_callback']);
  // Check for a TRUE or FALSE value.
  if (is_numeric($callback)) {
    $item['access'] = (bool) $callback;
  }

(and otherwise it calls the function.

So I guess the idea is to document that it can be not only "a function returning a boolean value", but also a number that can be cast to a boolean value. Sounds like a good idea, and it would be a good project for a novice Drupal contributor too.

chrisparsons’s picture

Status: Active » Needs review
FileSize
1.17 KB

Patch to add wording that jhodgdon described above.

tstoeckler’s picture

Status: Needs review » Needs work

Instead of mentioning that numbers that can be cast to boolean work, shouldn't we mention that booleans themselves work? I think that is much clearer.

jhodgdon’s picture

The current patch says:

"A function returning either a boolean value or a number that can be cast to a boolean value" ...

What we need to get across here is that it can be a number, a boolean value, or a function returning either one.

chrisparsons’s picture

Title: hook_menu 'access callback' docs should mention boolean values work too » hook_menu 'access callback' docs should mention boolean values work too and minor doxygen correction
Status: Needs work » Needs review
FileSize
1.54 KB

Here's what I came up with... not sure if it's just more verbosity for lack of clarity though.

"access callback": A boolean value or a number that can be cast to a
boolean value, that determines whether the user has access rights to this
menu item. Note that this value can be either set explicitly or a return
value from a function. Defaults to user_access() unless a value is
inherited from a parent menu item.

I've also made a small change on the theme callback description in that function just to meet Doxygen standards - "(optional)" instead of "Optional."

Patch attached.

tstoeckler’s picture

I think it should be documented the other way around, because using a callback is actually the "usual" use-case.

chrisparsons’s picture

FileSize
1.55 KB

Good point, and I think it reads better in that order as well.

"access callback": A boolean value or a number that can be cast to a
boolean value, that determines whether the user has access rights to this
menu item. Note that this value can be either set by the return value of
a function or set explicitly. Defaults to user_access() unless a value is
inherited from a parent menu item.

Quick reroll - still had it up on my screen.

jhodgdon’s picture

I think the idea is to leave it saying "a function..." and add something at the end saying it can also be a number or boolean?

chrisparsons’s picture

FileSize
1.54 KB

I talked with jhodgdon in IRC through this issue; I think this version sounds much better. Credit to jhodgdon, I'm just rolling the patch :)

"access callback": A function returning TRUE if the user has access 
rights to this menu item, and FALSE if not. It can also be a boolean 
constant instead of a function, and you can also use numeric values 
(will be cast to boolean). Defaults to user_access() unless a value is 
inherited from a parent menu item.
jhodgdon’s picture

I approve of this patch (obviously). Will let tstoeckler mark as RTBC...

tstoeckler’s picture

Yes, that reads much better. One final question that just popped up in my mind:
Should we leave it at saying: "Defaults to user_access()" because user_access() is the function that ends up being called, or is "Defaults to 'user_access'" clearer, because that is what you have to put in the menu declaration? I wasn't sure, so leaving at needs review.

jhodgdon’s picture

The nice thing about saying 'Defaults to user_access()' is that with the parens, it makes a link to the user_access() function on api.drupal.org. So I think we should leave that in...

That said, maybe we should change the text to say "the name of a function" and "Defaults to using user_access()" to make that abundently clear?

tstoeckler’s picture

Status: Needs review » Reviewed & tested by the community

Actually I find "Defaults to using" less clear. And the api.drupal.org thing is a pretty good reason.
RTBC from my point of view.

Dries’s picture

Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD. Thanks again.

Status: Fixed » Closed (fixed)
Issue tags: -Novice

Automatically closed -- issue fixed for 2 weeks with no activity.