Re: [development] Change URL on ajax call, but enforce access checks?

arg() checking is discouraged in modern drupal for this very reason. each drupal release we have been able to get rid of more of them in core and with the D6 menu system, I really doubt we need any of these calls to arg(). contrib modules that use arg() for access control should refactor and let the menu system handle access control. your workaround looks fine if it works and has no side effects. needs testing.