Programmatically override permissions in Drupal 6

Question

I'd like to know if there's any way to programmatically override Drupal's permissions defined in admin/user/permission.

What I've managed so far is to block a user's certain action. However, if a user is not permitted to perform an action (eg. "create custom_type content") and my module's access callback for this action returns TRUE the result is a white page. No PHP error, warning, or log entry. If FALSE is returned, I get an access denied page, as expected.

The method I used to implement custom permission is through hook_menu_alter(). Specifically, something like this (a common one for Drupal 6):

function mymodule_menu_alter(&$items) {
  $old_access_callback = $items['node/%node']['access callback'];
  $old_access_callback_add_customContent = $items['node/add/custom_type']['access callback'];

  $items['node/%node']['access callback'] = '_custom_node_access';
  $items['node/%node']['access arguments'] = array(1, $old_access_callback);

  $items['node/add/customContent']['access callback'] = '_custom_node_access';
  $items['node/add/customContent']['access arguments'] = array(1, $old_access_callback_add_customContent);
}

function _custom_node_access($node, $old_access_callback = "node_access"){
  //check if user has permission to view the node object 
  //or add new content and return TRUE or FALSE
}

Note that with 'node/%node' item, everything works as expected. When _custom_node_access() returns TRUE for a user that have no permissions to perform the certain action (add), I get a WSD. One way I found to avoid this behavior is to return my calculated result && user_access("create custom_type content") so that I can, at least, get an access denied page. Do you have any suggestion for this behavior?

Finally, _custom_node_access() seems to run more than one time every time the '/node/add/customContent' path is visited. Is there any particular reason for this?

It's been only few months since I started using Drupal so it's very likely that I'm missing something about permission...

Answer 1

There is a way to override programmatically drupal's permissions defined in admin/user/permission. Example:

<?php

function set_permission($rid, $permission) {
  $result = db_result(db_query("SELECT perm FROM {permission} WHERE rid = %d", $rid));
  if (is_array($result)) {
    $permissions = array_flip(explode(', ', $result));
  } else {
    $permissions = array();
  }
  $permissions[$permission] = true;
  db_query("DELETE FROM {permission} WHERE rid = %d", $rid);
  db_query(
    "INSERT INTO {permission} (rid, perm) VALUES (%d, '%s')",
    $rid,
    join(', ', array_keys($permissions))
  );
}

function unset_permission($rid, $permission) {
  $result = db_result(db_query("SELECT perm FROM {permission} WHERE rid = %d", $rid));
  if (is_array($result)) {
    $permissions = array_flip(explode(', ', $result));
  } else {
    $permissions = array();
  }
  unset($permissions[$permission]);
  db_query("DELETE FROM {permission} WHERE rid = %d", $rid);
  db_query(
    "INSERT INTO permission (rid, perm) VALUES (%d, '%s')",
    $rid,
    join(', ', array_keys($permissions))
  );
}

Answer 2

See the drupal doc how to resolve a white screen of death problem.