I use logic like this to place a tab on each user's profile page so users can view analytics from the usage of a WebApp:
// maps a url to a sub-page of user's profile, url to user's Analytics-Management form $items['user/%user/ClientCompanyName'] = array( 'title' => 'ClientCompanyName', 'description' => 'Manage your ClientCompanyName services.', 'page callback' => 'drupal_get_form', 'page arguments' => array('_ClientCompanyName_mgmt_form'), 'access callback' => 'user_access', 'access arguments' => array( 'access ClientCompanyName services' ), 'type' => MENU_LOCAL_TASK, );
This works great for each user, but I do not want one user to be able to go to another user's profile and hit their link to get to that other user's private analytics data.
Currently, if a user tries to visit another user's analytics management page, they see an access denied page.
But I would like them never to even be given the link to that page. I tried writing my own 'access callback', but I can't figure out how to pass in the '%user' portion of the intended url so I can test that against the logged in user...
I like how one can use '%' symbols in the url, and then 'page arguments' can be used to reference those arguments in the url. Is it possible to do something similar with the 'access arguments'?
Essentially, I'm trying to achieve the same thing as the behavior of the 'edit' tab on a user's profile: only if the user is on their own profile page will that 'edit' tab appear on the profile. How do I get the same effect for my WebApp analytics page?
(I guess I could make my analytics page a MENU_LOCAL_TASK of the profile edit form... but I'd still like to know how to create a conditional MENU_LOCAL_TASK whose conditional is more then simply an user_access() permissions test.)