New access permission for downloading profiles

On our site, unfortunately all registered users have access to the "Profile Export CSV", not just the ones who have management rights for user profiles. Checked the code, this is the menu call back containing the access limitation:

function profile_csv_menu($may_cache) {
  $items = array();
  if ($may_cache) {
    $items[] = array(
      'path'     => 'profile_csv', 
      'title'    => t('Profile Export CSV'),
      'callback' => 'profile_csv_page',
      'access'   => user_access('access user profiles'),
      'type'     => MENU_NORMAL_ITEM,
    );
  }  
  return $items;
}

Well, this would actually mean, display the menu to display this menu item to any user who can ACCESS user profiles, not just administering them. Interestingly enough, on a German localized site, this does also seem not to really work, the menu item is displayed to any user unfortunately, giving anybody the possibility to download profile information (which might also pose some privacy and hence legal problems).

Changing the access here in the menu callback does not do much unfortunately.

I guess, this approach of security is also not very good, maybe it should really be considered introducing a _perm function to the module, e.g. like this:

function profile_csv_perm() {
  return array('access profile cvs');
}

and later in the code change the access setting in the menu callback as well:

function profile_csv_menu($may_cache) {
  $items = array();
  if ($may_cache) {
    $items[] = array(
      'path'     => 'profile_csv', 
      'title'    => t('Profile Export CSV'),
      'callback' => 'profile_csv_page',
      'access'   => profile_csv('access profile cvs'),
      'type'     => MENU_NORMAL_ITEM,
    );
  }  
  return $items;
}

This would make the module pass through the permissions system before actually displaying it! This could also make it more fine-tuneable to the individual's need as this way, just specific roles based on the permissions settings could access profile_cvs.