2

Issue

I have a module that allows users to login as the customer (Spadar_Login). This modules uses user permissions. It works for admin roles and it prevents access to roles without permission. The issue is roles that are given permission do not work. It receives "Access denied" as though it did not have permission.

Troubleshooting

Cache has been cleared and disabled, compilation disabled, logged out and in.

The message is displayed on the admin side, for an admin route calling an admin controller. I removed any isAllowed() check in controllers. The controller being called has had all code removed and the issue still occurs, which tells me the access is denied before it reaches the controller. I tried removing the acl tag in the config.xml but the issue still persists. I have triple checked the the user is in the right role, and that the role has permission to the user.

Code

Here is the acl in the etc/config.xml

    <acl>
        <resources>
            <admin>
                <children>
                    <customer>
                        <children>
                            <login>
                                <title>Login as Customer</title>
                            </login>
                        </children>
                    </customer>
                </children>
            </admin>
        </resources>
    </acl>

Here is the route

<admin>
    <routers>
      <spadarloginadmin>
          <use>admin</use>
          <args>
              <module>Spadar_Login_Adminhtml</module>
              <frontName>spadarloginadmin</frontName>
          </args>
      </spadarloginadmin>
   </routers>
</admin>

What is causing this user role not to be able to access this controller?

  • Are you getting "Access denied in backend" ? – Baby in Magento Mar 24 '16 at 14:31
  • Yes, it's a backend button, on the admin, calling an admin controller. Will update to specify. – Goose Mar 24 '16 at 14:33
  • pls check the answer i posted & let me know – Baby in Magento Mar 24 '16 at 14:43
6

Complete credits for @fschmengler for this link

add this method in admin controllers:

if you have an ACL resource defined in etc/adminhtml.xml , than

protected function _isAllowed()
{
    return Mage::getSingleton('admin/session')->isAllowed('ENTER RESOURCE IDENTIFIER HERE');
}
  • You first statement is really bad in terms of security, admin controllers should always have an ACL resource defined and use the second bit of code you pasted. – Raphael at Digital Pianism Mar 24 '16 at 14:36
  • @RaphaelatDigitalPianism i will update my answer soon. – Baby in Magento Mar 24 '16 at 14:38
  • 1
    I used the second code block and it worked for me which looks secure to me. – Goose Mar 24 '16 at 14:50
  • @Goose Glad that it helped you. – Baby in Magento Mar 24 '16 at 14:53
  • @RaphaelatDigitalPianism As you said, i removed the first part of the code :-) – Baby in Magento Mar 24 '16 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.