Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

18

There are issue in Linux kernel security module (Security-Enhanced Linux (SELinux)) i.e SELinux permission issue. http://en.wikipedia.org/wiki/Security-Enhanced_Linux I have doing this by chcon -R -t httpd_sys_rw_content_t /var/www/html/magento/ chmod -R a+w /var/www/html/magento/


8

isAllowed() is used to check if your controller(for specific method) is authorized for logged in user or not. It by default returns true so you should define it to restrict from user. As you can see, by default, this method returns true. That means if you don’t define your own _isAllowed method your Admin Panel features will be open to any user with an ...


6

A Magento 2 plugin is: Used to extend or modify a public method’s behavior by applying code before, after, or around that observed method. If you're dealing with protected methods or properties then you cannot use plugins. Making your plugin class extends the original class is definitely not recommended at all. The list of plugins limitations is ...


6

Plugin should not inherit modified class. Also it's not recommended to inherit from non-abstract magento classes.


5

Go to System > Configuration > Webservice and you will find the settings for Magento's APIs. Depending on what kind of API they want to use (SOAP-XML / REST) you can create a user for that kind of API and a role to go with it. When creating the role I would advise you to be specific in what a third party can, and can not have access to. Only give ...


4

If you want to disable secure url for admin, you need to set the path web/secure/use_in_adminhtml value to 0 (or delete the record).


4

The fastet option you have is to create a new admin and reset the previous user's permissions. You can do it from command line. Move to your Magento's root and type: php bin/magento admin:user:create \ --admin-user="mynewuser" \ --admin-password="mynewpassword" \ --admin-email="john@doe.com" \ --admin-firstname="MyName" \ --admin-...


3

Problem resolved. By modifying _isAllowed() function like following protected function _isAllowed() { return true; } It's a very bad decision. In you case right way is: protected function _isAllowed() { return Mage::getSingleton('admin/session')->isAllowed('system/vendor'); }


3

Don't do chmod -R 777 /var/www/html since that will make your whole site writeable. See Magento Writeable Permissions Try Setting your folders, app and media to chmod -R 777 /var/www/html/magento/media chmod -R 777 /var/www/html/magento/var chmod -R 777 /var/www/html/magento/app/etc


3

You can write a small custom extension that checks if the user has permission to access the site. Your config.xml would look something like this <?xml version="1.0"?> <config> <modules> <[Namespace]_[Module]> <version>1.0.0</version> </[Namespace]_[Module]> </modules> <global&...


2

For reference this is the Magento web page linked to in the question: How to restore Admin access for failed TLS/SSL access with phpMyAdmin Symptoms: TLS/SSL Socket 443 failure is preventing access to my Administrative (backend | control panel) or my Admin has been set to use secure access before TLS/SSL has been activated Open your core_config_data table ...


2

You are on right path. The reason you are not finding the config path web/secure/use_in_adminhtml in the table is because it was never set in admin. Only values that are adjusted, or have values saved will get set in the table. If they don't exist, the defaults will be used. Defaults can either exist from code, or via the respective module's config.xml in ...


2

What you're reporting is the usual behaviour for Magento in a multistore setup. Unfortunately I don't think there are any free extensions available that will do what you're wanting but this extension does allow to create permissions and access only for specific stores in admin: http://www.aitoc.com/en/magentomods_advanced_permissions.html I would think ...


2

_isAllowed() method is used to check if a “role” has access to a “resource” and a particular “privileged” in that resource. This is mainly used in magento admin to check if admin user has access to a page. The code is implemented in ‘admin/session’ model, which has the isAllowed() method. The concept remain same in Magento 1 and Magento 2 Magento ...


2

You need to check the base unsecure url in admin. You may have mentioned as https://mydomain.com update mg_core_config_data table for the path unsecure url with http://mydomain.com


2

I found magento event catalog_product_collection_apply_limitations_after which is called after all basic limitations applied. app/code/Mymodule/Catalogaccess/etc/events.xml <?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd"> <...


1

If you want to preserve the existing user name "admin" setting the following columns in admin_user table solves the issue for me, Columns: Failure Number - 0 first_failure - NULL lock_expires - NULL PHP MyAdmin:


1

I think this is nothing to worry about after some further digging. I created a php file just to show what was base64_decode'd and it shows log_path/tmp/sfx.php From some research it looks like someone was trying to see if the website is powered by Joomla and trying to exploit a security issue in the Joomla CMS; https://krebsonsecurity.com/tag/sfx-php/ ...


1

Normally, that appears when you add a new user but you don't set good role: https://www.templatemonster.com/help/magento-how-to-deal-with-access-denied-issue-in-admin-panel.html In the table admin_role, do you have any row with 'Administrators' as role_name ? You can update your database to put right role to your user (look the tables admin_role / ...


1

First create token from Admin->System->integrations then use below code. $ch = curl_init("http://your_domain.com/index.php/rest/V1/customers/search?searchCriteria"); $token = 'your_token'; curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: application/...


1

Please try this ... add a custom module with this code: app/code/local/My/Module/etc/config.xml <?xml version="1.0" encoding="UTF-8"?> <config> <modules> <My_Module> <version>0.0.1</version> </My_Module> </modules> <global> <models> <...


1

Try using: return Mage::getSingleton('admin/session')->isAllowed('catalog/inventory/inventory');


1

I've build a small extension that might help. You can get it on Github. It works with an observer on the controller_action_predispatch event that will check if there is a customer session, if not it redirects to the login page. It can be enabled and disabled by storeview


1

This is on basis of chat with you it looks that your admin_rule table get clear it is not able to find a rule for your role. For this you have to create entry in this table for your role which is in admin_role table. or else you can upload a backup of your old table if you have. To make a user login 3 tables are taken into consideration whose relation are ...


1

This message will appear if you run composer update but don't follow up with the magento setup:upgrade command. After ensuring that your file permissions are correct after the upgrade, go to the magento webroot and run this command: php bin/magento setup:upgrade Depending on your system permissions, you might need to use sudo.


1

Someone solve this with permission 644 files and 755 on folders Others rename their .htacess file to .htacess-old and checked if the problem persist


1

In the scss directory lives an .htaccess file which contains: Order deny,allow Deny from all Remove it or comment it out and everything is fine.


1

The Groups Catalog by Vinai is a great extension which I am currently using to achieve similar purpose.


1

The credentials for the db are stored in app/etc/local.xml. Look in there.


1

Magento makes sure, that it only rewrites files that don't exist and if they are outside media skin and js: .htaccess ## always send 404 on missing files in these folders RewriteCond %{REQUEST_URI} !^/(media|skin|js)/ ############################################ ## never rewrite for existing files, directories and links RewriteCond %{...


Only top voted, non community-wiki answers of a minimum length are eligible