This page is archived
We're keeping this page up as a courtesy to folks who may need to refer to old instructions. We don't plan to update this page.
Create a permissions hook to secure access to pages within Drupal.
Goal
Require a user to have a certain permission before they can access a page.
Prerequisites
You will need the following knowledge and skills. If you need a review, check out the Additional resources section at the bottom of this page.
- How to use permissions hooks.
- Understand security issues within Drupal.
Tasks
Create a permissions hook, with a permission of ‘add movie review’ to restrict access to the custom movie import page.
For the role of ‘contributor’ in your demo site, add the permission ‘add movie review’, also ensuring access to create and edit their own Movie Review nodes.
Make a list of 10 issues which can affect security within Drupal.
Recap
- Maintaining a secure site within Drupal is essential, and a wide range of factors need to be taken into account to ensure this.
- Any custom code must take into consideration security issues by validating input and output.
Further your understanding
- Continue to the next lesson: Movie Project: Manage Configuration Changes.
Additional resources
- API Documentation: hook_permission (api.drupal.org)
- Video: Tips for Writing Secure Code
