I've created a custom module that allows you to delete orders. Now what I want is that when another user has logged in with a custom role (so not the Administrator), this function won't work. If I disable the resource responsible for deleting orders for the custom user, the user can still perform the action although the settings for disabling and enabling are not visible.

The .php file responsible checks if the module is enabled, and if so, it will run the code. If it is disabled, it should throw the following

else {
        $this->messageManager->addError(__("Either you're not allowed to delete orders or the function has been disabled"));

        $resultRedirect = $this->resultRedirectFactory->create();
        return $resultRedirect;

But unfortunately, when the function has been enabled by the Administrator, the function will also be enabled for other users.

Is there a work around for this, so that when the administrator is not logged in, the function will not work?

Thanks in advance.

-- SOLUTION (thanks to Shireen N) --

add the following function and use it as validation like so:

protected function _isAllowed() {
     return $this->_authorization->isAllowed('Vendor_Module::resource');

if ($enabled and $this->_isAllowed()) {
    // your code here

1 Answer 1


Follow this tutorial to achieve the desired results - https://www.magestore.com/magento-2-tutorial/3194-2/


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.