11

I've discovered that in the class \Magento\Backend\App\AbstractAction (the ancestor of every admin controller action) there is a member called _publicActions that is used in the validation of the secret key like this:

 if (is_array($this->_publicActions) && in_array($this->getRequest()->getActionName(), $this->_publicActions)) {
     return true;
 }

This means, that if a certain action name is listed in _publicActions you can access the action without the secret key in the url.
This is a blessing for development and debugging, because you can just do it like ROOT/admin/module/controller/action manually, without the need to know the secret admin key, but what I don't understand is why can I access the product edit page without the secret key.
Just call any product edit page like this ROOT/admin/catalog/product/edit/id/{product_id_here}.

The publicActions member is overwritten for orders (that allow index and view), in products (for edit) and in redirect controller for redirects.

Now my question:
Why are only some edit actions allowed without the secret key, and when/what should I allow in my custom CRUD modules without the secret key?

3

I have never seen an official answer from a Magento engineer on the matter, but to me it always appeared that this feature is to be used when you want users to be able to link to a page from outside a secure session, as otherwise clicking on a link referencing a secure admin URL will only redirect you to the dashboard after prompting you to log in.

I always had two scenarios in mind: Either you want users to be able to share certain admin pages with other users or you want some public page to reference your custom URL in the Magento back-end (which would otherwise only redirect to the dashboard).

When you look at the Magento core you can see that Magento has essentially implemented this for reviews, orders and product pages. I suppose the Magento engineers did this so that admin users of a store are able to send links directly through a messenger or an email (as in "Hey, check out this order: [url]."). I once implemented a feature like this for a page when I wanted it to be easily sharable by admin users.

You are basically trading the increased risk of a CSRF attack for the freedom of being able to directly link to a page in your admin back-end, which should only be done when you have a very certain use-case in mind. I suppose CMS Pages did not fall into the use-case for the Magento core team as they seemed to have limited this "feature" to actions related to customer support and the editing of products - basically the most common tasks for customer service representatives at many stores.

  • This makes sense. +1 If I don't hear an official answer (different than this one) from a team member in the next 24h, the checkmark is yours. – Marius Aug 26 '16 at 12:43
0

If I had to take a guess, I would say it's because the secret key may be used as a part of the CSRF and/or XSS protection built in to Magento. So for pages that don't modify its content based on user-input, it may not be necessary to have the secret key there.

Said another way, only actions who receive user-supplied data/input are protected with a secret key. Just a guess.

  • if that was true, then editing a CMS page should be "public" also. So should editing a customer or a tax rule. – Marius Aug 25 '16 at 21:30
  • That's a fair point; and TiEul's response does make sense. I was takin' a stab in the dark, looks like I missed. – Brett Aug 27 '16 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.