| 5 user.module | user_access($string, $account = NULL) |
| 6 user.module | user_access($string, $account = NULL, |
| 7 user.module | user_access($string, $account = NULL) |
| 8 user.module | user_access($string, $account = NULL) |
Determine whether the user has a given privilege.
Parameters
$string: The permission, such as "administer nodes", being checked for.
$account: (optional) The account to check, if not given use currently logged in user.
$reset: (optional) Resets the user's permissions cache, which will result in a recalculation of the user's permissions. This is necessary to support dynamically added user roles.
Return value
Boolean TRUE if the current user has the requested permission.
All permission checks in Drupal should go through this function. This way, we guarantee consistent behavior, and ensure that the superuser can perform all actions.
File
- modules/
user/ user.module, line 508 - Enables the user registration and login system.
Code
<?php
function user_access($string, $account = NULL, $reset = FALSE) {
global $user;
static $perm = array();
if ($reset) {
$perm = array();
}
if (!isset($account)) {
$account = $user;
}
// User #1 has all privileges:
if ($account->uid == 1) {
return TRUE;
}
// To reduce the number of SQL queries, we cache the user's permissions
// in a static variable.
if (!isset($perm[$account->uid])) {
$result = db_query("SELECT p.perm FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid WHERE r.rid IN (" . db_placeholders($account->roles) . ")", array_keys($account->roles));
$perms = array();
while ($row = db_fetch_object($result)) {
$perms += array_flip(explode(', ', $row->perm));
}
$perm[$account->uid] = $perms;
}
return isset($perm[$account->uid][$string]);
}
?>
Comments
Usage Example
1) Define a permission in hook_perm() in your module, here called "coolstuff.module".
<?phpfunction coolstuff_perm() {
return array('do cool stuff', 'do uncool stuff');
}
?>
2) Grant it to your users at admin/user/permissions.
3) Check it in a function.
<?phpfunction coolstuff_init() {
if (user_access('do cool stuff')) {
drupal_set_message(t('You can do cool stuff!'));
}
elseif (user_access('do uncool stuff')) {
drupal_set_message(t('You can do uncool stuff.'));
}
elseif (!user_access('do cool stuff') && !user_access('do uncool stuff')) {
drupal_set_message(t("You can't do stuff at all."));
}
}
?>
I personally have never used the $account parameter, but presume it could be used as follows:
<?phpfunction check_coolstuff($uid) {
$account = user_load($uid);
if (user_access('do cool stuff', $account)) {
drupal_set_message(t("The user @username with uid @uid has the permission to do cool stuff.", array('@username' => $account->name, '@uid' => $account->uid));
}
}
?>
Easy usage example
Use this to forward administrators or editor to the administration page upon login:
<?phpglobal $user;
if ($user->uid == 1 || user_access('access administration pages')) {
// Redirect admin to the administration page
return 'admin';
} else {
return 'node';
}
?>
Easy usage example more simple
Your example can be written even shorter since user_access() does the check for userid 1 for you.
<?phpif (user_access('access administration pages')) {
// Redirect admin to the administration page
return 'admin';
} else {
return 'node';
}
?>
Shorter, you say?
<?phpreturn user_access('access administration pages') ? 'admin' : 'node';
?>