ACL problem on new mass action in product grid 1.9

Question

In Magento 1.9 I have added a custom mass action in the product grid. I did it with an observer which adds to the Mage_Adminhtml_Block_Catalog_Product_Grid instance the item for the mass action and including in my custom module this:

<admin>
        <routers>
            <adminhtml>
                <args>
                    <modules>
                        <mymodule_catalog before="Mage_Adminhtml">Mymodule_Catalog</mymodule_catalog>
                    </modules>
                </args>
            </adminhtml>
        </routers>
    </admin>

Then in custom product controller file (ProductController.php) I added the handling of mass action

class Mymodule_Catalog_Catalog_ProductController extends Mage_Adminhtml_Controller_Action {

public function massTypologyAction(){
   ... // here is the logic of mass action
}

Everything works fine for the admin users (users who have all the privilges in the backend). But when I try to execute to the new mass action with another type of users with limited privileges (the users have the privilege to manage products), the system forbid me to execute that action. How can I tell Magento to allow this operation to users who have the rights to manage products?

Answer 1

There was a missing _isAllowed method in the controller. Since the controller extends the Mage_Adminhtml_Controller_Action I had to override the _isAllowed method in this way:

protected function _isAllowed()
{
    return Mage::getSingleton('admin/session')->isAllowed('catalog/products');
}

Without this overriding the _isAllowed method called was the one defined in the Mage_Adminhtml_Controller_Action class, which is defined in this way:

protected function _isAllowed()
{
    return Mage::getSingleton('admin/session')->isAllowed('admin');
}

so, it returns true only for admins and not for users with less privileges.