hook_menu() doc says that access callbacks are inherited - they mostly aren't

I see where that security announcement says that access callbacks are not inherited. Presumably this is true in D7 as well, and the doc should be fixed there first.

I would like to see someone verify in the menu building code that this fix is still in effect before we change the doc though.

Updating title. Still needs to be investigated for D7 and D6, to verify whether the doc is correct or not (the doc says access callbacks are inherited).

Another note: the menu system topic/group (which is located at the top of menu.inc) also says that access callbacks are inherited. So if this is wrong, we need to fix it there too.

In Drupal 7, it looks like access callbacks are inherited, but only for MENU_DEFAULT_LOCAL_TASK items. Here's the relevant code from _menu_router_build():

        // If an access callback is not found for a default local task we use
        // the callback from the parent, since we expect them to be identical.
        // In all other cases, the access parameters must be specified.
        if (($item['type'] == MENU_DEFAULT_LOCAL_TASK) && !isset($item['access callback']) && isset($parent['access callback'])) {
          $item['access callback'] = $parent['access callback'];
          if (!isset($item['access arguments']) && isset($parent['access arguments'])) {
            $item['access arguments'] = $parent['access arguments'];
          }
        }

This is identical in Drupal 6 as well, and is explained here (the change was made in **Drupal 6.2** and this has been wrong in the documentation since then!): http://drupal.org/node/244569

So the doc does need an update... here's a patch. If accepted, it also needs to be ported to Drupal 6.x.

Looks good. Please move to d6 after commit.

Committed to HEAD. Thanks!

Patch should be ported now to D6, which works exactly the same.

Sorry. I meant to do that, had a brain-fart.

Small D6 patch :)

Thanks! That patch looks good for Drupal 6.

We also need a patch for that fixes up the hook_menu() example (in D6, hook docs are in the Documentation project repository). If you are interested in doing that, you could attach it here -- just give it a file name that will make the test bot ignore it (see note below the Attach new file field when you attach the file).

It looks like the hunks for system.api.php are already in developer/hooks/core.php in the documentation project. Refs-

http://drupalcode.org/project/documentation.git/blob/refs/heads/6.x-1.x:...
http://drupalcode.org/project/documentation.git/blob/refs/heads/6.x-1.x:...

Unless I'm misunderstanding the need?

Correct, sorry I just assumed without actually checking. Thanks!

No prob at all!

Superb, committed, pushed.