1

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way could introduce a security issue, in the situation that a user does not have permission to view a certain node, but that menu link is still included in in the custom block.

I am wondering if there is some way of filtering results obtained from menu_links table based on current user role?

Menu links are currently being retrieved with queries like this one:

// Get all siblings of parent menu.
$siblings = db_select('menu_links', 'ml')
  ->fields('ml')
  ->condition('plid', $target['plid'])
  ->condition('hidden', 0)
  ->orderBy('weight')
  ->execute();

Actual menu structure is being constructed as a render array (basically each menu item is a link within a div wrapper). Below is example of how a menu item is being constructed:

foreach ($siblings as $sibling) {
  $link = l($sibling->link_title, $sibling->link_path);
  $menu_item = array(
    '#type' => 'container',
    '#attributes' => array(
      'class' => array('nav-level0'),
    ),
    'content' => array(
      '#markup' => $link,
    ),
  );
  $menu[] = $menu_item;
}
  • If you somehow get the path from the links before you render them you could call drupal_valid_path($path) to check if the current user has access. – schlicki Aug 21 '15 at 6:31
0

Yes, menu_get_item() will set return an access element that notes whether the current user has access.

  $siblings = db_select('menu_links', 'ml')
    ->fields('ml')
    ->condition('plid', $target['plid'])
    ->condition('hidden', 0)
    ->orderBy('weight')
    ->execute();
  foreach($siblings as $sibling) {
    $menu_item = menu_get_item($sibling->link_path);

    if($menu_item['access']) { 
      //Current user has access
    } else { 
      //Current user doesn't has access
    }
  }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.