How to change permissions of existing modules in Drupal

We’ve already seen how to hide a menu-item and change it’s tittle. Now I’ll show how to alter the permissions of an existing module.

This could be useful when we want finer grained control over the permissions we give to users.

How to alter an existing module’s permissions

We’re relying again on Drupal’s hook_menu_alter to change the permissions of menu-items.

Now, we need to target “access callback” and “access arguments”.

For example, the user’s module let’s everyone request a new password. It does so by implementing the following code within its hook_menu implementation.

$items['user/password'] = array(
    'title' => 'Request new password',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('user_pass'),
    'access callback' => TRUE,
    'type' => MENU_LOCAL_TASK,
    'file' => 'user.pages.inc',
);

Create new permission

We need to change the access callback into something else. Let’s define a new permission ‘request new password’.

/**
  * Implements hook_permissions().
  *
  * We want to create a new permission for requesting
  * a password
  */
function gluecode_permission() {
  return array(
    'request password' => array(
       'title' => t('Request new password'),
      'description' => t('Let a user request a new password.'),
    ),
  );
}

Override the existing permission settings

Now let’s override the “user/password” access settings and use our own permission.

/**
 * Implements hook_menu_alter().
 *
 * We want to change be more specific in the permissions we give to users.
 */
function gluecode_menu_alter(&$items) {
  $items['user/password']['access callback'] = 'user_access';
  $items['user/password']['access arguments'] = array('request password');
} 

We could define our own access callback instead of the user_access.

I know, the above code is pretty useless, since we should grant a role permission to request a password. This means only logged in users (with the permission) could request the password… and the hole point is that the user is not logged in and wants to request a password as an anonymous user. I just wanted to demonstrate how to do it.