0

I'm using a custom options extension that, on the Catalog > Manage Products page, enables me to select a few products and provide a source product ID and it will copy the custom options from the source product to the selected products.

It's working fine for Administrator accounts who is a Role with Resource Access to All. However, it keeps giving "Access denied" errors for accounts that's not Administrators, even so for accounts with a Role who has Resource Access set to Custom with ALL Resources selected. This is really weird.

My question is how can I find the exact privilege this extension needs to perform its job? Is there any exception logs this "Access denied" error would write to so I know what the exact privilege it needs and so I can probably modify its code to give it or work around the privilege?

My site has various catalog editors and it's obviously not wise to give them Administrator privileges with Resource Access to All.

What are my options in case of a problem like this?

  • May be a stupid question, but have you logged out and in again with the relevant accounts, after updating the permissions? – Louis B. Aug 13 '15 at 16:41
  • Any chance you applied one of the Magento security patches that came out this summer? Admin module controllers are now required to implement _isAllowed(), otherwise you get locked out by default. – Laura Aug 13 '15 at 17:53
  • @Laura, yes we did. Thank you all problem solved! – datasn.io Aug 14 '15 at 1:53
3

if the issue is for the custom/third-party modules, then you probably need to add the following function in the admin controllers:

protected function _isAllowed()
{
    return Mage::getSingleton('admin/session')->isAllowed('your module'); // or like module/controller etc.

}

In this way the permissions will return error only for the ones not selected/allowed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.