Hello all, I am trying to determine a good approach to identifying whether a specified menu path could be accessed by anonymous users, in an effort to implement some kind of baseline cacheable security for an Input Filter. However, I cannot specify a user with such functions as menu_get_item() to ask for the access right of an anonymous user. Is there a good approach to this? - abr/Grayside
Good afternoon Adam, I had a similar question, a while back, here is the answer I received. In short, no, there is no good approach to this :) If you do go down the path of changing the global $user object, then you will want to use session_save_session to make your code look something like this: // Don't save the session if the next block of code fails: session_save_session(FALSE); // Save the old user account someplace. $user = user_load(0); // Some computation.... // Something like this: $user = $the_old_user // Its now safe to start saving the session again: session_save_session(TRUE); </code> If your 'Computation' in the middle there fails, then the users session will be saved with the $user object you loaded up, i.e. they'll get logged out. Annoying at the moment, but if you ever change it to assign other users to the $user object then you might end up with people being logged in as other people if the 'computation' fails for some reason. Everett Zufelt http://zufelt.ca Follow me on Twitter http://twitter.com/ezufelt View my LinkedIn Profile http://www.linkedin.com/in/ezufelt On 2010-09-20, at 1:07 PM, Adam B. Ross wrote:
Hello all,
I am trying to determine a good approach to identifying whether a specified menu path could be accessed by anonymous users, in an effort to implement some kind of baseline cacheable security for an Input Filter.
However, I cannot specify a user with such functions as menu_get_item() to ask for the access right of an anonymous user. Is there a good approach to this?
- abr/Grayside
Aahg! So the natural followup to such a mess is whether it's a good idea. To do that. Potentially many times in a page load, since this is to satisfy Freelinking's access control routine that it's safe to admit things like "nid 32 does exist, and here is it's title". I am trying to have some kind of decent behavior without mandating the cache gets turned off. On Mon, Sep 20, 2010 at 10:16 AM, E.J. Zufelt <lists@zufelt.ca> wrote:
If your 'Computation' in the middle there fails, then the users session will be saved with the $user object you loaded up, i.e. they'll get logged out. Annoying at the moment, but if you ever change it to assign other users to the $user object then you might end up with people being logged in as other people if the 'computation' fails
participants (2)
-
Adam B. Ross -
E.J. Zufelt