Users with "administer menu" should see all the items in admin/structure/menu (regardless access callback return in hook_menu) [#1048750]

Comment #1

montesq commented 2 February 2011 at 19:12

Status:

Active

» Closed (works as designed)

"access callback": A function returning TRUE if the user has access rights to this menu item, and FALSE if not. It can also be a boolean constant instead of a function, and you can also use numeric values (will be cast to boolean). Defaults to user_access() unless a value is inherited from the parent menu item; only MENU_DEFAULT_LOCAL_TASK items can inherit access callbacks. To use the user_access() default callback, you must specify the permission to check as 'access arguments' (see below).

If the value is FALSE, the user can't access this menu so it doesn't need to display this link...

Log in or register to post comments

Comment #2

snufkin commented 2 February 2011 at 19:45

So how would you position a menu item that you created in a custom module that is visible only under certain conditions (say user is not authenticated then show the login link, if user is not authenticated then dont)? The menu item should be visible on the admin UI.

Log in or register to post comments

Comment #3

montesq commented 2 February 2011 at 20:22

Category:

bug

» support

If the access callback is set to FALSE, the menu would be *never* available.
In fact, access callback must be set to the function that will return TRUE if the user is able to access to this menu, FALSE if not.
You can use access arguments if needed.
Almost every module implements hook_menu, for example, you can look at the user.module to have some examples...

Log in or register to post comments

Comment #4

snufkin commented 2 February 2011 at 21:51

I am talking about the case when the access callback returns FALSE to hide the element...

An example: your module implements a logout and a login link, programmatically. Obviously you dont want to show the logout link to an anonymous user, and the login to an authenticated, so you use an access callback function that checks the login status and returns true/false accordingly.

Now assume that you would fancy placing these items somewhere in the menu. You cant, because you are logged in, so the admin interface will not show the logout link, since the access callback returned false. So you must give permission to the anonymous user to configure menus. And all this assumes that the access callback looks at a simple thing, like authentication status.

I hope I made my request a bit clearer.

For the records: chx explained to me that the main reason why these issues are closed is because they would lead to information disclosure about links that the person accessing the admin ui should not have access. If aforementioned feature is needed implement the access callback so that your admin user can get a TRUE return regardless of underlying conditions.

Log in or register to post comments

Comment #5

montesq commented 2 February 2011 at 23:01

Title:	Menu admin UI should show menu items regardless of their access callback	» Users with "administer menu" should see all the items in admin/structure/menu (regardless access callback return in hook_menu)
Version:	7.x-dev	» 8.x-dev
Category:	support	» feature
Status:	Closed (works as designed)	» Active

Ok, well understood. I've tried to rephrase the issue title. Does it make sense for you?
However, currently a user with administer menu is not able to create a menu linked to an invalid or out of reach page. So it's quite logical that he/she can view it in the item menu list...