Menu items still appear when path access is restricted

For future reference the magic is done in:

/**
 * Implementation of hook_menu().
 * @param may_cache Return cacheable menu items?
 * @return array of menu items
 */

function remove_nonviewable_menu_items_menu($may_cache) {
  $poisoned_items = array();

  if ($may_cache) {
    if (module_exists('menu')) {
      $result = db_query(db_rewrite_sql('SELECT m.mid, m.* FROM {menu} m ORDER BY m.mid ASC', 'm', 'mid'));
      while ($item = db_fetch_object($result)) {
        $normal_path = drupal_get_normal_path($item->path);
        if (substr($normal_path, 0, 5) == 'node/') {
          if(is_numeric(substr($normal_path, 5))) {
            $nid = substr($normal_path, 5);
            $node = node_load($nid);
            if (!node_access("view", $node)) {
              // User cannot view this node.   
              $poisoned_items[] = array('path' => $item->path, 
                'access' => FALSE,
                'title' => $item->title);
            }
          }
        }
      }
    }
  }
  return $poisoned_items;
}

I tried figuring out how to convert this d5 code to d6 and it didn't work out. There may be still a solution. What I decided to do is use javascript to check all menu items on the loaded page.

Attached is the patch that handles this.

Could this be handled by http://api.drupal.org/api/function/hook_menu_alter/6 in D6?

Yeah I have the same issue!

I think this should be an option and not set in the code as I like the fact that the menus still show up so the user can see what options they would have as an authenticated user. I would like an option for the path restriction to display the user a popup window with a definable message letting the user know that there is restricted access.

+1 for making this optional

Side note, Nonviewable Menu Items http://drupal.org/project/remove_nonviewable_menu_items is for D5, there is no D6 version.

Another +1 for optional. I definitely want people to see the menu items they don't have access to... so they know what's there :)

Subscribe

+1 for optional. One of the main reasons I'm looking at this module over other access modules is that this one allows the menu items to remain in the menu, meaning that users can still see what menu items would be available if they were logged in.

In the Drupal 7 branch, access checking is done using hook_menu_alter and so the menu items are hidden when access to them is restricted - this is Drupal core behavior.

There is a module called always_visible which lets you mark menu items as being always visible regardless of the user's permission to view the content.

It's think it's better to have the access module remove the menu items (as in the case with path_access for D7) as this is standard and expected behavior, and then if people want those menu items to show regardless, then use the always_visible module.

I'm now maintainer of this module, and have been working mainly on the Drupal 7 branch. However, I think it would be good if both the D6 and D7 branches did the same thing - ie. restricting access to a menu item should remove it from the menu, and then use always_visible if you still want it to show. It's a more flexible approach, and is more inline with how other access modules behave.

I don't use the D6 version of this module, but how do you all fee about altering it so that it is more inline with how things are being done in D7? It would probably make upgrading easier for you.

Hi,

Any news on this being 'fixed'. It would be really useful if version 6 worked as per 7.

Cheers
Zap

This is actually documented on the front page... The path access is not checked the same way as the menu otherwise expects.

This being said, I would think that the project page of this module should mention the Menu per Role module as an extension one can use to hide "unwanted" menu items.

Thus, at this point, there is probably no need to make the Path Access 6.x module more complicated than it needs to be. There is no Menu per Role for 7.x (yet) so that could be something to add...

Thank you.
Alexis Wilke

I've added the Menu Per Role module link to the Drupal 6 section of the homepage.

I don't know, always_visible isn't even released yet, and it would be just for 7. I think making it optional for 6 would be ideal - consistency only makes sense if everything else is equal, and in this case it isn't...

#11 It's not working for me in D7 with beta1. The access control works perfectly but users with access restricted can still see the menu item. In case it helps, in my case the problem is in the main_menu.

Regards.

Same issue. Menu still appears although anonymous users do not have access. Also using an item in the main menu.

I created views page path and tried to restrict access. Didn't work. tried PATH and PATH/*

Same issue here.

I have placed "user/register", , and other pages under anonymous users for testing purposes and all are still visible.

Please advise.

Thanks

Changing to active bug report in hopes of getting a response as this seems to be functionality that is available but may not be working properly.

Thanks

The Path Access module is not attempting to do anything itself to hide menu items of urls which are restricted. So this thread is a feature request.

If this is NOT a bug, then WHY does the actual behaviour differ from that stated on the module page?

Stated:

if access is denied to a particular path, menu items that lead to that path will be hidden.

Actual behaviour: (Steps to reproduce)

• Restrict a path, say lib/* , so that anonymous users may not access it.
• Create some nodes and make aliases for them, say lib/art1 , lib/art2 , etc.
• Log out or open another browser, to view the site as the anonymous user.
• Menu items still show up, although lib/art1 gives "access denied".

I confirm #23. So #11 is not true for me.

I have set it back to a bug, because as per #23, the module page clearly states that menu items will be hidden in D7. If the maintainer does not wish to support this behaviour, then it is at least a documentation bug - please could you update the module page?