In a 3rd party module that we have, the controllers for routes are configured with <use>admin</use>. So then it extends Mage_Adminhtml_Controller_Action and adding function _isAllowed() does not solves the access denied for non-admin user. would removing <use>admin</use> be the solution?


If you want to allow non-admin access, the controller MUST NOT extend Mage_Adminhtml_Controller_Action.

You would also need to change <use>admin</use> from "admin" to "default".

But depending on what the controller does, it might not work outside the admin area, you have to try it out.

| improve this answer | |
  • Thanks I'll try your suggestions tonight and keep here updated – Zinat Aug 19 '16 at 7:20
  • Unfortunately, it did not work. Changing admin to default leads to 404 page and removing the extending part leads to a blank page :( – Zinat Aug 22 '16 at 6:41
  • The blank page is a PHP fatal error, that means the controller does things that only work in admin area, as I suspected. That could be using the admin session or changing entities that are read only in frontend. At this point I can only guess. If you inspect the server error logs and find the code responsible for the error, you should be able to find out (or ask a new question with these details) – Fabian Schmengler Aug 22 '16 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.