I'm new to drupal and when I looked at table {role_permission}, I found that permissions were stored as text string (e.g. "edit own page content"). But when I did a grep in drupal's folder, for some permissions they only appeared in *.test files (In those files, some users with those permissions are created). It seems that some permissions, like "edit own page content", are not used at all, otherwise they should appear somewhere else when they are checked.

Any insights on access control mechanism in drupal would be appreciated.

Thanks, ZM

  • @downvoters/closevoters I think this is a pretty reasonable question. It does look quite broad on the surface, but really the bulk of it is "why do I see permissions like 'edit own page content' when I can't find that exact string in any code files?". Speaking from experience, Drupal's string-based permissions can initially be a bit confusing for developers coming from other frameworks.
    – Clive
    Oct 27 '13 at 15:42

A straight grep for the full string may not find these, but they're used. For instance look in the modules/node/node.module, where you find calls such as:

if (user_access('edit any ' . $type . ' content', $account)
  || (user_access('edit own ' . $type . ' content', $account)
  && ($account->uid == $node->uid))) {

Note that the string is constructed on the fly, where the content type (e.g. page) is inserted into a template to form the string "edit own page content".

These strings are mostly used to call user_access, so to see where and how they're used, you may want to search for this function.

  • I see. Thx a lot!
    – user23200
    Oct 27 '13 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.