I'm currently programming a module that contains several Ajax calls, some of them with Add / update & Delete requests in the DB. Now I am thinking about the fact that it will be necessary to check the ACL state in the functions called via Ajax in addition to the frontend check (not visible if not in the right group). Unfortunately I can't find an example how to realize this. It is supposed to be that the admin should be able to give user groups the possibility to make changes via Frontend GUI or to prevent them via the modules permissions.
But I can imagine that a simple "hide" of the options in the frontend is not enough if the function is slumbering in the background and can be called without any check by AJAX...
I've already passed the module title into the AJAX call and now I failed because the permissions don't seem to be available via
to the $module... the $user object is available via
and waits to be compared with the information according to the ACL settings of the module instance...
So, how do I get to the permission settings of the module instance to check if the user who made the ajax call is allowed to do so?