Drupal：触发了访问被拒绝，但我还是得到了内容
我正在构建一个网站，为每个用户提供一个私人主页，其中包含他们可以看到但其他人看不到的内容。如果用户是页面的所有者，则 _menu 处理程序中的回调允许访问，否则拒绝访问；那里一切都很好。
我刚刚修改了该页面，使其内容由一组框而不是一大堆代码组成。内容正确地组合在一起，但有一个问题：如果用户 A 查看用户 B 的私人页面，他会得到一个“访问被拒绝”页面，这是他应该得到的。但是，这些块仍然会被调用，并且它们的内容仍然会出现在页面上，这样用户 A 就可以看到用户 B 的私人内容。该页面也没有出现通常的“您无权访问此页面”。通常显示在拒绝访问页面上的消息。
我完全不明白为什么会发生这种情况。我可以通过给它们一些正确设计的“在特定页面上显示块”功能来阻止这些块运行，但仍然会发生一些事情，(a) 看起来不正确，(b) 我不明白。总之，这让我对网站的访问控制发生的情况有一种不好/有趣的感觉，特别是它与块的关系。有人可以在这里提供任何见解吗？谢谢！
I'm building a site that gives each user a private home page with content they can see but others cannot. The callback in a _menu handler allows access if the user is the owner of the page and denies it otherwise; all is well there.
I've just revised that page so that its content is made up of a set of boxes instead of a big bag of code. The content comes together correctly, but with a problem: If user A looks at user B's private page, he gets an Access Denied page, as he should. However, the blocks are still invoked, and their content still ends up on the page, such that user A can see user B's private stuff. The page also does not get the usual "You are not authorized to access this page." message that typically shows up on an Access Denied page.
I'm at a total loss to understand why this is happening. I can keep the blocks from running by giving them some properly-designed "Show block on specific pages" functions, but there's still something happening that (a) doesn't seem right and (b) I don't understand. Together, this gives me a bad/funny feeling about what's happening with access control for the site, especially as in the way it relates to blocks. Can anybody offer any insight here? Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您应该在挂钩菜单中创建一个访问回调函数来执行访问检查。否则，即使您不渲染任何内容，用户也可以查看内容。由于块不是通过菜单回调创建的，因此它们会正常渲染。
有关参考，请参阅：
hook_menuYou should create an access callback function in your hook menu to do the access check. Else the user is allowed to see the content, even if you don't render anything. Since the blocks are not created through the menu callback they are rendered normally.
For reference, see:
hook_menu