1

We have a new overseas developer and we thought it would be better to take the safe side when giving access to the Dashboard, we created a separate account but need to limit access.
I attached an image for the Roles available and would appreciate to tell me which ones to restrict. The developer will apply security patches, updates, customization... But still we believe that giving full access would be risky.
I appreciate your help, image attached. enter image description here

  • please inform devoloper will do what updates and customizations ? dont you give him files and database access ? – Baby in Magento Jul 14 '16 at 11:44
  • 2
    First...don't restrict your developer. If you don't trust him, find another one. Second. If he has access to the code and wants to cause harm he can and will. So, don't restrict your developer. Third...if you restrict his access to some sections and he blindly does some changes and screws up something on those sections? So, don't restrict your developer. – Marius Jul 14 '16 at 11:46
  • What I mean is that since he will have full access, he may be able to change the administrator password or billing access, or we won't be able to recover the Dashboard. The hosting provider said that it's not necessary to give Database or cPanel access from now. – Ashraf Jul 14 '16 at 11:46
  • 1
    @Marius I don't really know him yet and he won't be next to me. What we are doing is the wrong decision? – Ashraf Jul 14 '16 at 11:48
  • 1
    @QaisarSatti Thank you! I will do that, mainly User access so he won't change the username and password! – Ashraf Jul 14 '16 at 18:16
0

I understand your fear but, as said in the comments, the best solution is have someone you trust and will have full access.

What you can do is: create a new role for your developer and give access to everything, except:

  • Dashboard
  • Sales (all checkbox in this tree)
  • System > Permissions > Roles (just this checkbox)
  • System > Permissions > Users (just this checkbox)

This way, he will not be able to change users or password of your admin. Also, in a few exceptions, a developer don't need access to the dashboard and to the sales module.

You can do this to start a relationship with the developer, see if he will match your expectations and start trust him. With this access he will be able to create new pages and do some customization for you.

Now, one important point is: Access to the database, FTP and SSH is very necessary. He will need this, for example, to install new Magento security patches.

  • This is exactly what I am willing to do, I restricted them now plus what QaisarSatti mentioned. I created FTP access for him, but also he needs access for the cPanel? – Ashraf Jul 14 '16 at 18:49
  • Not for what you said, however, he may need access later to the database or some hosting information. Most of the hosting companies allow you to create a "developer" user in cPanel that will not have access to billing and financial account, that could be a temporary solution as well. – Bruno Monteiro Jul 14 '16 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.