Access Denied errors showing for a permission assigned user (created custom module) after installing SUPEE-6285

Question

I installed SUPER-6285 patch on our Mangeto 1.13.1.0. and created a custom module for sales and assign that modules to a user. Showing access denied for that users

I applied the below function in my controller.

Path : controller/Adminhtml/OrderController.php

class Vtrio_OfflineOrders_Adminhtml_OrderController extends Mage_Adminhtml_Controller_Action
{
    protected function _isAllowed(){
       return Mage::getSingleton('admin/session')->isAllowed('sales/vtrio_offlineorders');
    }
}

adminhtml.xml

<?xml version="1.0"?>
  <config>
    <menu>
     <sales>
         <children>
           <vtrio_offlineorders>
             <title>Offline Orders</title>
             <action>adminhtml/order/</action>                
             <sort_order>2</sort_order>
           </vtrio_offlineorders>
         </children>
     </sales>
   </menu> 
   <acl>
    <resources>
      <admin>
        <children>
          <sales>
              <children>
                  <vtrio_offlineorders>
                      <title>Offline Orders</title>
                  </vtrio_offlineorders>
              </children>
            </sales>
         </children>
       </admin>
     </resources>
   </acl>
 </config>

When i open the custom order module and trying to create an order, first time the order is not getting created (2nd time onwards it will)

Answer 1

I can see you are using <sales> node, which might be playing the role for you. Sales is most cases used by magento.

I don't know how whole adminhtml.xml looks like? But after looking at acl,

Change these as follow:

Controller class

class Vtrio_OfflineOrders_Adminhtml_OrderController extends Mage_Adminhtml_Controller_Action
{
    protected function _isAllowed(){
       return Mage::getSingleton('admin/session')->isAllowed('vt/vtrio_offlineorders');
    }
}

adminhtml.xml

<acl>
  <resources>
    <admin>
      <children>
          <vt>
              <children>
                  <vtrio_offlineorders>
                      <title>Offline Orders</title>
                  </vtrio_offlineorders>
              </children>
          </vt>
      </children>
    </admin>
  </resources>
</acl>

You also want to change sales to vt in other part of adminhtml.xml.

This should work.