Hey all
I need some advice with this... The only sure fire way I can see to test for permissions with what I'm trying to accomplish is to not set any access restriction in the menu hook and test for permissions in the callback function itself. Here's my code to test, although tbh it's quite irrelevant as it's not what I'm worried about...:
/**
* Edits one row in a table.
*/
function tablemanager_edit($edit) {
global $user;
if (!is_numeric($edit)) {
drupal_access_denied();
}
$fetch = db_fetch_object(db_query('SELECT tm.tid, tm.uid AS tableuid, tm.name, tmd.uid, tm.header, tmd.data, tmd.format
FROM {tablemanager} tm
INNER JOIN {tablemanager_data} tmd ON tm.tid = tmd.tid
WHERE tmd.id = %d',
$edit));
if (!$fetch) {
drupal_not_found();
}
unset($flag);
$flag = $user->uid == $fetch->uid && user_access("edit own '".$fetch->name."' content") ? TRUE : $flag;
$flag = user_access('administer tables') || user_access("edit any '".$fetch->name."' content") ? TRUE : $flag;
$flag = $user->uid == $fetch->tableuid && user_access('administer/ create own tables') ? TRUE : $flag;
if (!$flag) {
drupal_access_denied();
}
...rest of code....
What I'm worried about is how easy this is to bypass? Everyone has permission to access this function, they're only denied once they're actually 'in it'... So if they pass POST variables to it will they get stopped at the access denied message or will they actually get as far as the validate or *gasp* the submit hook??? I'm assuming I have nothing to worry about, but as a few people use my module now I don't want to make a mistake and open up a huge security hole :o(