I think medical marijuana is legal. As long as he has a valid permission from a licensed physician, he should be alright, but don't hold me to it. It should also be noted that some places, like Santa Cruz, don't enforce weed possession very much, but it's still risky.
I don't smoke weed, but I know an online friend of mine who does, who also plans to visit California in the future (it's some kind of herb that has similar effects as marijuana). I'm concerned that my friend could get arrested for bringing those herbs to California when crossing with a boarder patrol on a road between two cities.