1

They are allowed to view everything but not edit anything... Is this possible?

Here's what the function looks like now, perhaps i did something wrong?

    public function preDispatch()
{
    // override admin store design settings via stores section
    Mage::getDesign()
        ->setArea($this->_currentArea)
        ->setPackageName((string)Mage::getConfig()->getNode('stores/admin/design/package/name'))
        ->setTheme((string)Mage::getConfig()->getNode('stores/admin/design/theme/default'))
    ;
    foreach (array('layout', 'template', 'skin', 'locale') as $type) {
        if ($value = (string)Mage::getConfig()->getNode("stores/admin/design/theme/{$type}")) {
            Mage::getDesign()->setTheme($type, $value);
        }
    }

    $this->getLayout()->setArea($this->_currentArea);

    Mage::dispatchEvent('adminhtml_controller_action_predispatch_start', array());
    parent::preDispatch();
    $_isValidFormKey = true;
    $_isValidSecretKey = true;
    $_keyErrorMsg = '';
    if (Mage::getSingleton('admin/session')->isLoggedIn()) {
        if ($this->getRequest()->isPost()) {
            $_isValidFormKey = $this->_validateFormKey();
            $_keyErrorMsg = Mage::helper('adminhtml')->__('Invalid Form Key. Please refresh the page.');
        } elseif (Mage::getSingleton('adminhtml/url')->useSecretKey()) {
            $_isValidSecretKey = $this->_validateSecretKey();
            $_keyErrorMsg = Mage::helper('adminhtml')->__('Invalid Secret Key. Please refresh the page.');
        }
    }
    if (!$_isValidFormKey || !$_isValidSecretKey) {
        $this->setFlag('', self::FLAG_NO_DISPATCH, true);
        $this->setFlag('', self::FLAG_NO_POST_DISPATCH, true);
        if ($this->getRequest()->getQuery('isAjax', false) || $this->getRequest()->getQuery('ajax', false)) {
            $this->getResponse()->setBody(Mage::helper('core')->jsonEncode(array(
                'error' => true,
                'message' => $_keyErrorMsg
            )));
        } else {
            $this->_redirect( Mage::getSingleton('admin/session')->getUser()->getStartupPageUrl() );
        }
        return $this;
    }

    $_acl_user = Mage::getSingleton('admin/session')->getUser();
    if($_acl_user &&  $_acl_user->getId()) $_acl_role_id = Mage::getSingleton('admin/session')->getUser()->getRoles();
    else
       $_acl_role_id = 0;
    if($_acl_role_id > 0)
       $_acl_role = Mage::getModel('admin/roles')->load($_acl_role_id)->getRoleName();
    else
       $_acl_role = 'None';

    if($this->getRequest()->isDispatched() && $this->getRequest()->getActionName() !== 'denied' && (!$this->_isAllowed() || ($_acl_role == 'ReadOnlyAccess'
    && preg_match('/(add|reset|generate|save|update\delete)/' ,$this->getRequest()->getActionName()))) ) {
      $this->_forward('denied');
      $this->setFlag('', self::FLAG_NO_DISPATCH, true);
      return $this;
    }




    if ($this->getRequest()->isDispatched()
        && $this->getRequest()->getActionName() !== 'denied'
        && !$this->_isAllowed()) {
        $this->_forward('denied');
        $this->setFlag('', self::FLAG_NO_DISPATCH, true);
        return $this;
    }

    if (!$this->getFlag('', self::FLAG_IS_URLS_CHECKED)
        && !$this->getRequest()->getParam('forwarded')
        && !$this->_getSession()->getIsUrlNotice(true)
        && !Mage::getConfig()->getNode('global/can_use_base_url')) {
        //$this->_checkUrlSettings();
        $this->setFlag('', self::FLAG_IS_URLS_CHECKED, true);
    }
    if (is_null(Mage::getSingleton('adminhtml/session')->getLocale())) {
        Mage::getSingleton('adminhtml/session')->setLocale(Mage::app()->getLocale()->getLocaleCode());
    }

    return $this;
}

1 Answer 1

1

I did this read-only change for Magento 1 a while ago.

What you need:

  1. create backend permission role with the name ReadOnlyAccess
  2. create backend user and assign ReadOnlyAccess role to it
  3. overwrite Mage_Adminhtml_Controller_Action class preDispatch function to filter denied actions:

     cp app/code/core/Mage/Adminhtml/Controller/Action.php \
    app/code/local/Mage/Adminhtml/Controller/Action.php
    
    
    187  $_acl_user = Mage::getSingleton('admin/session')
                          ->getUser();
    188  if($_acl_user && $_acl_user->getId())
    189    $_acl_role_id =
            Mage::getSingleton('admin/session')
                ->getUser()
                ->getRoles();
    190  else
    191    $_acl_role_id = 0;
    192  if($_acl_role_id > 0)
    193     $_acl_role = Mage::getModel('admin/roles')
         ->load($_acl_role_id)->getRoleName();
    194  else
    195     $_acl_role = 'None';
    
    196  if ($this->getRequest()->isDispatched()
    197         && $this->getRequest()->getActionName()
                !== 'denied'
    198     && (!$this->_isAllowed() ||
       ($_acl_role == 'ReadOnlyAccess'
     && preg_match('/(add|reset|generate|save|update|delete)/'
          ,$this->getRequest()->getActionName())))    ) {
    199        $this->_forward('denied');
    200        $this->setFlag('', self::FLAG_NO_DISPATCH, true);
    201        return $this;
    202  }
    
  4. Clear Magento cache:

    rm -rf var/cache/*
    

Originally published as https://www.goivvy.com/blog/magento-admin-backend-read-only-access-role

7
  • Thank you @Konstantin Gerasimov. I'm using Magento ver. 1.14.2.4 and you would think they would of built something like this before out of the box.
    – Head
    Apr 20, 2017 at 23:40
  • I agree. They could've I think it should work more or less the same for EE 1.14 give it a try Apr 20, 2017 at 23:45
  • Why doesn't any of the if or else statements have brackets? { }
    – Head
    Apr 21, 2017 at 2:49
  • Gerasimov, please have a look at my code above. It doesn't seem to be working for me. Thank you.
    – Head
    Apr 21, 2017 at 3:00
  • Looks to be OK. does the user have ReadOnlyAccess role? put die("ok") in this file - does it display ok? is that the correct file you put code in app/code/local/Mage/Adminhtml/Controller/Action.php ? Apr 21, 2017 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.