3

Clean install of Magento ver. 1.9.2.4

I created a user and created a custom role for this user by going to the roles section.

When I've selected the option of "all" in roles it works perfectly. I can go to:

Customers > Manage customers > Select customer > Newletter

and activate the newsletter on this page.

But when I use custom roles, as in, I select "custom" but still select each and every option that's there ( Which to my knowledge, is the same as "all" that has been proven to work, like I mentioned before ) I don't have the same outcome. I can navigate to the exact same section as before, select the checkbox and save and it even gives me the according success message

"The customer has been saved." but the checkbox reverts to it's previous state.

I've looked, but couldn't find a ACL issue like I mention above.

Is this a known issue, and have I not looked good enough. Or is there a bypass that I can use for this to make it possible for not correct ACL roles to still perform this action?

1

If you look at the source code in Mage_Adminhtml_CustomerController::saveAction(), it checks for the ACL resource customer/newsletter and silently does not save the subscription if you are not allowed to.

Now here's the problem: Neither Mage_Newsletter nor Mage_Customer define this resource, so it's not possible to give a restricted user access to it. You found a bug.

As a workaround you can create your own module that defines the missing resource. It only needs a minimal config.xml and module activation file and this adminhtml.xml:

<?xml version="1.0"?>
<config>
    <acl>
        <resources>
            <admin>
                <children>
                    <customer>
                        <children>
                            <newsletter translate="title">
                                <title>Newsletter</title>
                                <sort_order>200</sort_order>
                            </newsletter>
                        </children>
                    </customer>
                </children>
            </admin>
        </resources>
    </acl>
</config>

Then you will be able to add the Customer > Newsletter permissions to your user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.