I need to make some checks on node access form based on user/role attributes that cannot be handled by Drupal core modules, so i think to do them in _form_alter hooks.

Which is the best thing to do when the user has not access to the form edit ? I can do a drupal_goto(...) but i would like to stay in the same form, showing an access denied command. How can i do it?

1 Answer 1


I think the standard way to handle this would be to implement hook_node_access(), make your checks there, and deny access if any of your conditions aren't met.

This will result in the standard 403 page when a user without the correct permissions tries to access the page, which semantically speaking would probably be the best result.

The code might look something like:

function MYMODULE_node_access($node, $op, $account) {
  $type = is_string($node) ? $node : $node->type;

  if ($type == 'my_type' && ($op == 'create' || $op == 'update')) {
    if ($account->something == 'something') { // allow access
      return NODE_ACCESS_ALLOW;
    else {
      return NODE_ACCESS_DENY;

  // Return the default ignore value if your module doesn't need to get involved in this decision

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.