0

I have a custom module that works fine if you are an admin user. If I have a user with limited permissions and allow them to access the custom module, they can see the admin menu, but when they click on it, they get Access denied. I believe something is wrong with the ACL.

Config.xml

<?xml version="1.0"?>
<config>
  <modules>
    <Freshproduce_Careers>
      <version>0.1.0</version>
    </Freshproduce_Careers>
  </modules>
  <frontend>
    <routers>
      <careers>
        <use>standard</use>
          <args>
            <module>Freshproduce_Careers</module>
            <frontName>careers</frontName>
          </args>
      </careers>
    </routers>
        <layout>
          <updates>
            <careers>
              <file>careers.xml</file>
            </careers>
          </updates>
        </layout>
  </frontend>
  <admin>
    <routers>
        <careers>
            <use>admin</use>
            <args>
                <module>Freshproduce_Careers</module>
                <frontName>careers</frontName>
            </args>
        </careers>
    </routers>
  </admin>
  <adminhtml>
    <menu>
        <freshproduce module="careers">
            <title>Fresh Produce</title>
            <sort_order>100</sort_order>
            <children>
                <careers module="careers">
                    <title>Careers</title>
                    <sort_order>30</sort_order>
                    <action>careers/adminhtml_careers</action>
                </careers>
            </children>
        </freshproduce>
    </menu>
    <layout>
        <updates>
            <careers>
                <file>careers.xml</file>
            </careers>
        </updates>
    </layout>
        <acl>
            <resources>
                    <all>
                        <title>Allow Everything</title>
                    </all>
                <admin>
                    <children>
                         <freshproduce>
                            <children>
                                <careers>
                                    <title>Careers</title>
                                </careers>
                            </children>
                        </freshproduce>
                    </children>
                </admin>
            </resources>
        </acl>
  </adminhtml>
  <global>
    <helpers>
      <careers>
        <class>Freshproduce_Careers_Helper</class>
      </careers>
    </helpers>
    <blocks>
      <careers>
        <class>Freshproduce_Careers_Block</class>
      </careers>
    </blocks>
    <models>
        <careers>
            <class>Freshproduce_Careers_Model</class>
            <resourceModel>careers_mysql4</resourceModel>
        </careers>
        <careers_mysql4>
            <class>Freshproduce_Careers_Model_Mysql4</class>
            <entities>
                <careers>
                    <table>careers</table>
                </careers>
            </entities>
        </careers_mysql4>
    </models>
    <resources>
        <careers_setup>
            <setup>
                <module>Freshproduce_Careers</module>
                <class>Freshproduce_Careers_Model_Mysql4_Setup</class>
            </setup>

            <connection>
                <use>core_setup</use>
            </connection>
        </careers_setup>

        <careers_write>
            <connection>
                <use>core_write</use>
            </connection>
        </careers_write>
        <careers_read>
            <connection>
                <use>core_read</use>
            </connection>
        </careers_read>
    </resources>
  </global>
</config> 

enter image description here

I also tried add this code to my admin controller, but didn't seem to have any effect:

protected function _isAllowed() {
    return Mage::getSingleton('admin/session')->isAllowed('careers');
}

I have read the Alan Storm article on ACL: http://alanstorm.com/magento_acl_authentication

and yet this still doesn't work. If someone can help me I would be happy to share more code or dig into the core if anyone knows where to look for the issue.

2

The ACL path for your module declares as freshproduce/careers so you should be verifying the access is allowed against that rather than against careers. See the modified _isAllowed below which has the proper ACL path in it.

protected function _isAllowed() {
    return Mage::getSingleton('admin/session')->isAllowed('freshproduce /careers');
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.