<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial; font-size: 10pt; color: #000000'><div class="content"><p>I located the source of my problem. In the user_access() function, the static variable $perm is set to hold the permissions for a user. <br></p><p><br></p>
<p>Issuing this command: user_access('', NULL, TRUE); (<a href="http://api.drupal.org/api/function/user_access/6" title="http://api.drupal.org/api/function/user_access/6" rel="nofollow">http://api.drupal.org/api/function/user_access/6</a>)
will unset the $perm variable and allow it to reset with the permissions from the most
current roles. My debug code indicates that it contains the correct permissions from the roles of the $user object.</p>
<p><br></p><p>However, when I issue:<br>
</p><div class="codeblock"><code><br>module_invoke($module, 'access', 'create', $type, $user);</code></div><br>
which, in the case of $module = <b>'node_content'</b> will itself call <code>user_access($permission, $user)</code>,<br>
the $perm value is now set (as it should be from my reset command), but
no longer contains the all permissions from the roles in the $user object (what was
originally set), but only the ones you would find for the user in the <b>role</b>
table. Furthermore, I put debug code into user_access() to show me each
time it is ran. I do not see it accessed between the time $perm is
unset (by my reset command) and it is called by module_invoke().
<p><br></p><p>The way this worked in 5.x:</p>
<p><b>hook_init()</b> would issue <b>user_access('', NULL, TRUE)</b>
which would unset the $perm variable so that the next time
user_access() ran, it would rebuild $perm. In 6.x appears this no
longer works in the same way.</p>
<p><br></p><p>So, it looks like either:</p>
<p>a. Another module (other than the user.module) is manipulating the $perm variable, or;<br>
b. Drupal core is assuring, when module_invoke() is used, that the set
$perm variable only contains roles that the user has in the roles table.</p>
<p><br></p><p>My question is this: Can the $perm variable be manipulated outside
of the user.module? If not, then how is b. above accomplished?</p>
<p><br></p><p>Thanks for any assistance whatsoever!</p><p><br></p><p>-ron<br></p><p><br></p>
</div>----- Original Message -----<br>From: "Ron Parker" <sysop@scbbs.com><br>To: development@drupal.org<br>Sent: Friday, October 24, 2008 12:03:05 PM GMT -08:00 US/Canada Pacific<br>Subject: Re: Has anything changed with module_invoke() recently?<br><br><style>p { margin: 0; }</style><div style="font-family: Arial; font-size: 10pt; color: rgb(0, 0, 0);"> Ron Parker said: "This same exact code worked in 5.x, so I have to believe there is
something that has changed in 6.x with module_invoke() / $user .
Furthermore, this code worked in the initial Drupal 6.x versions, so
this change, whatever it is, is rather recent. Theoretically, module_invoke below should not return false, but it is"<br><br> Nancy Wichmann said: "I
have recently run into problems with hook_access. It is widely
misunderstood and many module return false when they really should be
returning null. I even had to change many of my modules. I know
there are many out there that are still wrong."<br><br>Could someone please point me to how I begin to solve this problem? I am certain that the user object contains the correct roles that should allow permission. How do I track down what's going on with module_invoke?<br><br>-ron<br></div></div></body></html>