5

The _isAllowed method is where you, as a Admin Panel programmer, should place your ACL checks. As you can see, by default, this method returns true. That means if you don’t define your own _isAllowed method your Admin Panel features will be open to any user with an Admin Panel account, and people using your code will have no way to restrict access to your features. This may not be a problem, but it’s definitely something you should be aware of.

Source: http://alanstorm.com/magento_acl_authentication

Without overriding _isAllowed (so it always return true as inherited from parent class), I tried with another account as a role that doesn't have that resource checked in the Permission -> Role.

Using that account, I cannot see that resource in the admin menu. Also when trying to access that resource by modifying the URL, I got redirected to Dashboard.

So it seems pretty secured to me, just wondering what's the reason (if any) we better override that _isAllowed function?

  • As you have already said this using for checking access – zhartaunik Apr 27 '15 at 11:32
  • not good idea to override – Amit Bera Apr 27 '15 at 11:37
  • I've added more info related to my question. Just wondering what's the consequence if I do not override the function, hence leaving it always return true; as I seem not to be able to do anything so far. – Alvin Nguyen Apr 27 '15 at 11:55
  • Why not good idea to override? It depends on situation. Look at magento core modules. They often override this method instead of using parent – zhartaunik Apr 27 '15 at 12:01
5

Visibility in the admin menu is not determined by the controller and its _isAllowed method but directly by the ACL. If you want the menu to be always visible and not controlled by ACL, don't define it in your modules adminhtml.xml.

The redirect to dashboard if you enter the URL manually probably comes from a missing/wrong key parameter that prevents hotlinking of admin URL, if the following setting is enabled:

admin/security/use_form_key


Side note: Since Magento 1.9.2 (and for all previous versions that have the SUPEE-6285 security patch applied), the following is not true anymore:

As you can see, by default, this method returns true. That means if you don’t define your own _isAllowed method your Admin Panel features will be open to any user with an Admin Panel account, and people using your code will have no way to restrict access to your features

The default now is, that it only returns true if the user has Full Admin Access. That means, if you don't override _isAllowed(), your menu is not accessible for any restricted user.

The idea behind this change is to fail secure instead of fail safe, i.e. prefer to err in favor of security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.