Using the secret admin frontname in a new adminhtml router

Question

I have a module that uses an abnormal naming convention. Instead of NAMESPACE_MODULE it uses NAMESPACE_MODULE_SUBMODULE:

$ find app/code/community -type f
app/code/community/Acme/ModuleName/Bar/etc/config.xml
app/code/community/Acme/ModuleName/Bar/Model/Observer.php
app/code/community/Acme/ModuleName/Core/etc/config.xml
app/code/community/Acme/ModuleName/Core/Model/Observer.php
app/code/community/Acme/ModuleName/Foo/controllers/IndexController.php
app/code/community/Acme/ModuleName/Foo/etc/config.xml
app/code/community/Acme/ModuleName/Foo/Helper/Data.php
app/code/community/Acme/ModuleName/Foo/Model/Foo.php

This works fine for everything except controllers, since they don't use the autoloader. Specifically this piece from core:

# File app/code/core/Mage/Core/Controller/Varien/Router/Standard.php

public function getControllerFileName($realModule, $controller)
{
    $parts = explode('_', $realModule);
    $realModule = implode('_', array_splice($parts, 0, 2));
    $file = Mage::getModuleDir('controllers', $realModule);
    if (count($parts)) {
        $file .= DS . implode(DS, $parts);
    }
    $file .= DS.uc_words($controller, DS).'Controller.php';
    return $file;
}

Because array_splice is only taking 2 parts it ends up looking for my controllers in Acme/ModuleName/controllers instead of Acme/ModuleName/Foo/controllers. To work around this I am using my own router with a modified getControllerFileName() that can correctly load the controller file.

This works great in the frontend, where there is no issue with accessing the frontname directly (example.com/modulenamefoo).

However, now I need to create an adminhtml controller/router. I've set things up the same:

<adminhtml>
    <routers>
        <acme_modulename_admin>
            <use>acme_modulename_admin</use>
            <args>
                <module>Acme_ModuleName_Core</module>
                <frontName>acme_modulename_admin</frontName>
            </args>
        </acme_modulename_admin>
    </routers>
</adminhtml>

And this too is working. However, I've hardcoded the frontname which means anyone can access example.com/acme_modulename_admin and brute force my admin login.

Is it possible to use the same adminhtml frontname in a different router?

I've tried overriding collectRoutes() in my router so that it uses the configured secret admin frontname but it is not working. Even throwing in a

$this->addModule(
    (string)Mage::getConfig()->getNode(Mage_Adminhtml_Helper_Data::XML_PATH_ADMINHTML_ROUTER_FRONTNAME),
    array('Acme_ModuleName_Core'),
    'adminhtml'
);

doesn't work.

Even if I modify app/etc/local.xml and set the secret frontname for admin/routers/acme_modulename_admin/args/frontName, what's the magic that replaces adminhtml in things like the menu urls in adminhtml.xml or $this->getUrl('adminhtml/foo/*')?

Answer 1

Try Changing your config.xml to looks like below and remove the custom router you created.

<?xml version="1.0"?>
<config>
    .........
    <admin>
        <routers>
            <adminhtml>
                <args>
                    <modules>
                        <Acme_ModuleName_Core before="Mage_Adminhtml">Acme_ModuleName_Core_Adminhtml</Acme_ModuleName_Core>
                    </modules>
                </args>
            </adminhtml>
        </routers>
    </admin>
    ........
<config>