1

I have a module on a website, called members, and 2 roles: "low admin" and "manager". They have permissions: 'low admin tasks' and 'manager tasks'. Every low admin has access to both permissions.

There is an edit member form. Manager must be able to view the data, but not be able to update. Low admin can do both operation. Here is the code:

function members_menu()
{
       $items = array();

       //members_edit calls members_edit_form
       $items['members/edit'] = array(
           'page callback'    => 'members_edit',
           'access arguments' => array('manager task'),
           'type' => MENU_CALLBACK,
           );

       return $items;
}

function members_edit_form($form, &$form_state, $data_array = NULL)
{
    //here I prepare the fields
    ...

    //submit button is shown only for the low admin
    if (user_access('low admin tasks'))
    {
        $form['submit'] = array(
            '#type' => 'submit',
            '#value' => t('Submit'),
            );
    }

}

function members_edit_form_submit($form, &$form_state)
{
    if (user_access('low admin tasks'))
    {
        //save to the database
    }
}

Is it possible to remove the condition from members_edit_form_submit and set somewhere (maybe in members_menu), that only users with 'low admin tasks' privilege can call members_edit_form_submit?

3

It's an odd use-case where certain roles can view the form itself, but not submit it. Perhaps better to allow non-privileged users to view the rendered form output instead of the input form.

That way, you can put the access check on the menu callback for the form itself.

Anyway, have you considered putting the access check into the form validate function?

e.g

function members_edit_form_validate($form, &$form_state)
{
  if (!user_access('low admin tasks'))
  {
    form_set_error('submit', t('Sorry, you do not have access to update this form'));
  }
}
2
  • Interesting, but your code didn't work until I changed NULL to ''. Like this: form_set_error('', t('Sorry, you do not have access to update this form')); Why is that? – user4035 Jul 23 '13 at 10:45
  • Thanks, normally you pass the element name there, you could pass the submit name, though docs showed default NULL appeared ok. Answer updated to pass empty string instead. – David Thomas Jul 23 '13 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.