How can I get Drupal to hide menu items that user does not have permission for?

Question

I thought Drupal was supposed to do this (and sometimes it does), but I'm not seeing this behaviour, so thought I'd ask.

My Main Menu contains three manually-added links to useful stuff.

1. Administration - this one auto-hides; cannot be seen by anonymous users.

2. Application - provided by a Module. Does not auto-hide, yet the module defines the path as requiring a certain permission that anonymous users don't have.

3. Documentation - link to a Documentation node type. I'm using Content Access Control and have not provided permission to view this content type for anon users. Should be hidden but is not.

Can anyone explain when drupal hides stuff and when it won't be able to? Obviously there's the "install yet another module" approach that will provide a brute-force fix, but I'm interested in why the behaviour is erratic/unreliable.

Answer 1

Drupal does this using access callback from the menu items.

In the example given:

1. This was working.

2. The Application had TRUE for the access callback. As this was not my application, I used hook_menu_alter in my own module to set the access callback for this argument to my own function. This then checked the permission and returned true/false.

3. The Contact Access module requires rebuilding permissions (/admin/reports/status/rebuild) after any changes.