CODEWITHSUNDEEP
phpsecuritydrupaldrupal-7
Josh
Josh

Reputation: 3823

Drupal 7: Using "global $user" secure?

In Drupal 7: Is there any major security issue manually using php to pull from global $user. Such use as displaying content to specific a role(s) in my case. Or is it best practice to stick to strictly using Views/Panels/Blocks in the CMS to hide/display content?

Exam: if (in_array('moderator', $user->roles)){//reveal editable links}

Thanks

Upvotes: 0

Views: 112

Answers (1)

mikeharty
mikeharty

Reputation: 132

Assuming the code you're implementing is secure (ie: there's no chance that the $user object can be overwritten and allow higher privileges to a lower-privileged user), there's nothing inherently insecure about using the global $user object.

That said, it's best practice to use views/blocks/panels wherever possible, to maintain a consistent and maintainable implementation.

Without more specific details, that's the most I can offer. Feel free to update your question and I will add more.

Upvotes: 2

Related Questions