6

I want to remove the delete button from a standard edit form in certain cases and I'm looking for the right way to do that.

So far I found that hide() marks an element as already rendered so it basically tricks the rendering process.

['#access'] = FALSE does something similar I guess, but still a little different.

In both cases, nothing is rendered concerning the delete button, but does either of them prevent the delete code from being executed on submit (e.g. if a user was manipulating the POST request)?

Or would I need a form_validate() method for that anyway?

  • I think that you could also ask for the unset($form['element']) function aswell! It is usually used for the same purpose! Don't you think? – Djouuuuh Dec 10 '14 at 14:58
  • 1
    @Djouuuuh: That one is discussed in drupal.stackexchange.com/questions/49984/…. Unset is PHP, thus just throwing bits away. – Koen Dec 10 '14 at 15:02
8

Hiding the element is done during the rendering process. If you look at the code, it just marks the element as already being rendered.

The #access key on the element is used during the form build process (can't find my chart, so I can't tell you exactly which part). It says that this element is part of the form, but a particular user may or may not have access to be able to use it.

Unsetting the element, just throws the element away and says it is not part of the form anymore.

Of the three options, using #access is preferred: it's the API so you should use it. When you just hide the element, a user can still submit that element git GET/POST as the Form API thinks it is still valid. For non-submit elements, I believe the #default_value will also appear in $form_state['values'] when you validate/submit (however I don't recall the last time I tested this).

  • Hopefully chx will see this, as I think he wrote the original FAPI implementation. – mpdonadio Dec 10 '14 at 15:13
  • This one seems to me a very satisfying answer. – Djouuuuh Dec 10 '14 at 15:33
  • chx is a hero, but not omnipotent – autopoietic Dec 10 '14 at 19:00
1

Using hide() will simply prevent that form element from being displayed. The same would be true of unset().

My understanding is that setting #access to false means that even if the POST request is manipulated, the input from that element will not be accepted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.