Theme printed twice when access denied

That's because drupal_access_denied() does not end the request.

It would be better to re-factor the code so we don't have to call exit(). Calling exit() is quite drastic and prevents that certain handlers run, e.g. register_shutdown_function() handlers.

I couldn't reproduce this bug.

I got the fresh copy from cvs.
Installed the Drupal.
Logged out.
Viewed the url.
I didn't see the theme printed twice.

What should I do?

pp

You should mark it as needs more info ;)

I think it is unimportant whether this can be replicated or not.

This issue clearly identifies that the proper usage of drupal_access_denied() - which is important for security - is unknown.

Proposal:

- Let drupal_access_denied() return MENU_ACCESS_DENIED and not print anything at all.

- Rename drupal_access_denied() to drupal_access_denied_page(), so it clearly describes that it outputs a page.

- So developers can simply do:

return drupal_access_denied();

- And index.php will ensure to take the appropriate steps.

Given the regular page request and processing flow, I think that would be much more grokable. At least, every other callback in Drupal returns something. For any reason, we apply a completely different concept here.

FWIW, the same applies to drupal_not_found().

If there is an important reason to handle these pages so differently, then we should at least update the PHPDocs of those functions to contain a code example that clearly shows how developers should implement the function. That said, this issue makes me nervous whether I'm using those functions properly in my modules.

Tagging. See also #122130: Replace drupal_not_found() and drupal_access_denied() with constants

sun's ideas are good but not critical, imo

Not an issue in Drupal 7.0. Can't replicate the bug.

We should investigate the proposed improvements for D8.

Received same problem after update D7.12 -> D7.14. Do not remember anything like this before update.

Downgrade back to D7.12 not help - problem persists.

same problem, my users can't login after register new account (new accounts are validated by email)

applying the patch from #3, solves the problem with duplicated theme content. by users still can't access to password reset/set form.

#1463656: Add a Drupal kernel; leverage HttpFoundation and HttpKernel makes this entire issue obsolete for D8.

In D7, this should not happen, but if it does, then that hints at some broken code in a module or theme.

In D6 and below, this can happen more often, but there's no way to fix that other than refactoring access/page callback code (core code should not be affected though).

In my case that issue appears when I call drupal_access_denied() in one of my hooks. The page is displayed twice, stacked vertically.

Then I tried to do the following:

drupal_access_denied();
exit;

After that the page displayed only once, but I the output is a bit strange. See the attached image.

as sun wrote, when you see this problem then you have broken code in a module or theme.