Infinite redirects with drupal_goto

Question

I am writing my own 403 page, and would like to redirect the user to the login page if the user is not logged in. I use this code in a page callback, but when I am viewing an unauthorized page (say /user/1) as anonymous user, I got infinite redirect to /user/1.

function MODULE_membercheck() {
    global $user;
    if (!$user->uid) {
        //drupal_goto('user/login', array('query' => array('destination' => 'member/check')));
        drupal_goto('user/login'); //these two lines won't work 
        return;
    }
    // other stuff.
}

update

It is quite easy to reproduce the problem. Just create a module and add a menu (member/check), and redirect anonymous user to login page in the page callback function. Then set the default 403 page to this menu entry, and try to open an unauthorized page.

Answer 1

Where is MODULE_membercheck() getting called from? It would seem that it's getting called on user/login page requests which makes these pages redirect to themselves, hence the infinite loop.

You can either modify the calling of the function to ensure it doesn't get called on the login page or add a check in your function to make sure the current path is NOT user/login before doing the redirect, something like this:

function MODULE_membercheck(){
  global $user;
  if (!$user->uid && current_path() != '/user/login') {
    drupal_goto('user/login', array('query' => array('destination' => 'member/check')));
  }
  // other stuff.
}

Answer 2

Below are 2 options to implement what you're looking for, provided using a contributed module for this is acceptable (if not you may want to use it as a temporary work around).

Option 1: Use the CustomError module

The CustomError module allows the site admin to create custom error pages for HTTP status codes 403 (access denied) and 404 (not found), without creating nodes for each of them. Some more details about its features (from its project page):

• Configurable page title and descriptions.
• There are no author and date/time headers as with normal nodes.
• Any HTML formatted text can be be put in the page body.
• The error pages are themable.
• Users who are not logged in and try to access an area that requires login will be redirected to the page they were trying to access after they login.
• Allows custom redirects for 404s.

You'll probably be interested mostly in the part about "Users who are not logged in and try to access an area that requires login will be redirected to the page they were trying to access after they login.".

Option 2: Use the Rules module

Assume the path of the "Default 403" page is set to no_access (via admin). Then create a rule using the Rules module, with as Event something like "After visiting node no_access". So that the entire rule would look something like so:

• Events: After visiting node no_access

• Conditions:

  1. User has role(s) - Parameter: User: [site:current-user], Roles: anonymous user
  2. NOT Text comparison - Parameter: Text: [site:current-page:url], Matching text: user/login

• Actions: Page redirect - Parameter: URL: user/login

Answer 3

I was also running into redirection loop with drupal_goto() (was trying to send anonymous users to login page) with no obvious reason. Then I replaced drupal_goto() with php's header() redirection and it worked well. Not sure what was the problem with drupal_goto() but other one saved the day. It's worth trying.