Separate permissions for form access and form submit

Question

I have a module on a website, called members, and 2 roles: "low admin" and "manager". They have permissions: 'low admin tasks' and 'manager tasks'. Every low admin has access to both permissions.

There is an edit member form. Manager must be able to view the data, but not be able to update. Low admin can do both operation. Here is the code:

function members_menu()
{
       $items = array();

       //members_edit calls members_edit_form
       $items['members/edit'] = array(
           'page callback'    => 'members_edit',
           'access arguments' => array('manager task'),
           'type' => MENU_CALLBACK,
           );

       return $items;
}

function members_edit_form($form, &$form_state, $data_array = NULL)
{
    //here I prepare the fields
    ...

    //submit button is shown only for the low admin
    if (user_access('low admin tasks'))
    {
        $form['submit'] = array(
            '#type' => 'submit',
            '#value' => t('Submit'),
            );
    }

}

function members_edit_form_submit($form, &$form_state)
{
    if (user_access('low admin tasks'))
    {
        //save to the database
    }
}

Is it possible to remove the condition from members_edit_form_submit and set somewhere (maybe in members_menu), that only users with 'low admin tasks' privilege can call members_edit_form_submit?

Answer 1

It's an odd use-case where certain roles can view the form itself, but not submit it. Perhaps better to allow non-privileged users to view the rendered form output instead of the input form.

That way, you can put the access check on the menu callback for the form itself.

Anyway, have you considered putting the access check into the form validate function?

e.g

function members_edit_form_validate($form, &$form_state)
{
  if (!user_access('low admin tasks'))
  {
    form_set_error('submit', t('Sorry, you do not have access to update this form'));
  }
}