An Adobe Commerce developer is asked to restrict access onboth the admin menu item Custom_Reports: :Financial and the admin pagecustomreport/financial/index attached to the menu. The developer has added the resource Customreports/financial in etc/ael.xml. and the following code on etc/adninhtml/menu.xml :

enter image description here

Given that const ADMIN_RESOURCE was NOT set on the controller of customreports-financial/index and the secret key is not enabled in the URL which users can access the page?

A. Only admin users with Custom_Reports::financial resource access.

B. Only admin users with ALL resources access.

C. All admin users.

What is the correct answer for the above question?

1 Answer 1


The correct answer must be C. All admin users.

If you take a look in \Magento\Backend\App\AbstractAction, when the Action is dispatched this simple method is checked:

 * Determines whether current user is allowed to access Action
 * @return bool
protected function _isAllowed()
    return $this->_authorization->isAllowed(static::ADMIN_RESOURCE);

As ADMIN_RESOURCE is not set in the custom Action, it allows all users:

 * Authorization level of a basic admin session
const ADMIN_RESOURCE = 'Magento_Backend::admin';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.