Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

129

As written here: If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton('admin/session')->isAllowed('admin'). Extensions that do not override this method in ...


24

I have a hunch you have in your admin controller a method called _isAllowed. If that's true, I think it returns the wrong thing. It should look like this: protected function _isAllowed() { return Mage::getSingleton('admin/session')->isAllowed('erp/stock_management/firtal_deadstock'); //or at least //return Mage::getSingleton('admin/...


22

In your system.xml replace this <tab>HelloWorldMVVM</tab> with this <tab>Pulsestorm</tab>


16

As @Cags said, this is not (easily) possible because the ACL tree is loaded when the session is initialized (AKA when the admin logs in). A possible workaround would be to override the _isSectionAllowed method in system configuration controller: (Mage_Adminhtml_System_ConfigController::_isSectionAllowed) and make it reload the ACL tree. Something like: ...


10

A general explanation: ACL for admin menu To define the ACL for a custom admin menu entry, copy everything below adminhtml/menu to acl/resources/admin/children and remove the <action> nodes. Example: What to copy To actually use the ACL you have to add the following method to your controller: protected function _isAllowed() { return Mage::...


10

Set is_visible to 0 on the attribute and it won't show up in admin forms (product page and also the attribute management page). You can do it via a SQL tool or programmatically in a setup script: $installer->updateAttribute('catalog_product', $attribute_code, 'is_visible', '0');


9

I found a way around this with very little customization. What we need is: A new controller action that reloads the ACL (without logging out and in), then redirects back to the previous page: class SSE_AclReload_Adminhtml_Permissions_AclReloadController extends Mage_Adminhtml_Controller_Action { public function indexAction() { $session = ...


8

This is possible with observing the events core_block_abstract_prepare_layout_before (method removeAttributes()) and core_block_abstract_prepare_layout_after (method removeTabs()). remark: I am putting this into a module which adds ACL entries for each attribute / tab so they can be hidden from certain users. In the observers we have to check, that we are ...


8

you need to create a plugin to disable the existing ACL record first In di.xml <!-- remove existing record from ACL --> <type name="Magento\Integration\Helper\Data"> <plugin name="my-acl-data" type="VendorName\ModuleName\Plugin\Integration\Data" sortOrder="100" /> </type> VendorName\ModuleName\Plugin\Integration\Data.php ...


7

I want to explain a bit what @Sander Mangel said in his answer: make sure the Adminhtml controller of the module has a _isAllowed method Look for files like this: /app/code/community/your/module/controllers/Adminhtml/SomeController.php and make sure there's a method that looks like this inside every admin controller: protected function ...


7

If you look at how the admin menu is built in Mage_Adminhtml_Block_Page_Menu, you will notice, that the full menu path is only used as ACL resource, if the menu item does not have a resource specified: protected function _buildMenuArray(Varien_Simplexml_Element $parent=null, $path='', $level=0) { ... foreach ($parent->children() as $childName =&...


7

First mistake is .xsd file configuration, In magento 2 stable release it should be <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd"> and second mistake is section should be darsh instead of darsh_banner third mistake is <tab>darsh_banner</tab&...


6

Complete credits for @fschmengler for this link add this method in admin controllers: if you have an ACL resource defined in etc/adminhtml.xml , than protected function _isAllowed() { return Mage::getSingleton('admin/session')->isAllowed('ENTER RESOURCE IDENTIFIER HERE'); }


5

There are a couple of thinks you can check make sure the Adminhtml controller of the module has a _isAllowed method check if the path in the _isAllowed method matches you ACL in the adminhtml.xml file make sure the cache is cleared after creating the role


5

I don't have a fully functional way of doing this, but I might have an idea. If you take a look at the Mage_Adminhtml_Block_Catalog_Product_Edit_Tab_Attributes class, the one that renders the attribute tabs on the products add/edit page, you will see this in the _prepareForm method if (Mage::registry('product')->hasLockedAttributes()) { ...


5

Visibility in the admin menu is not determined by the controller and its _isAllowed method but directly by the ACL. If you want the menu to be always visible and not controlled by ACL, don't define it in your modules adminhtml.xml. The redirect to dashboard if you enter the URL manually probably comes from a missing/wrong key parameter that prevents ...


5

Here are main points about Magento 2 authorization system: The same acl.xml is declaring resources used for backend actions protection and web API. It means, authorization system is now unified Resulting merged acl.xml is used to build 2 identical ACL trees for managing permissions in the admin panel. One is on the admin user role edit page, another is on ...


4

This is syntax how to create the Menu in Magento Admin Panel you can follow this /app/code/local///etc/adminhtml.xml <?xml version="1.0"?> <config> <menu> <[module] module="[module]"> <title>[Module]</title> <sort_order>71</sort_order> <children> &...


4

In short: What you call "the role" is the group (like "Administrators"). Each group has an entry with the type G and each user has an entry with the type U which refers to the user's group via parent_id. All access rules are defined at group level. If you look at the table admin_rules, you will see that all entries have G as role type. The admin_rule....


4

You can create a custom module for that and use a before plugin for \Magento\Integration\Helper\Data::mapResources(). Let's name the module StackExchange_Acl. You will need these files: app/code/StackExchange/Acl/registration.php - the registration file <?php \Magento\Framework\Component\ComponentRegistrar::register( \Magento\Framework\Component\...


4

This is the file where you define the module access control list resources. Those resources can be seen under the admin : System > Permissions > User Roles section when you click on Add a new Role button. If you're not familiar with ACL, I suggest you read this good article from Alan Storm (even though it was written for M1 it is still relevant to ...


4

I just done this and it is working perfectly now <?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd"> <acl> <resources> <resource id="Magento_Backend::admin"> <resource ...


4

Assuming you can see the menu item, and thus the ACL is set-up correctly, you need to manually make your controller check the ACL too, by adding the following to your controller: protected function _isAllowed() { return Mage::getSingleton('admin/session') ->isAllowed('catalog/outofstocksubscription'); } Whilst the menu renderer checks the ...


3

Create adminhtml.xml at Webcreon/Seller/etc where you need put your code <?xml version="1.0" encoding="UTF-8" ?> <config> <acl> <resources> <all> <title>Allow Everything</title> </all> <admin> <children> ...


3

Yes, the that is 'the group'. Each user has a User Role which has a parent of a Group Role, all users are assigned to a group via the parent_id in that table. The only real value I can see is in the acl generation where they can dump in the whole table and generate the acl structure based on the information provided, in Mage_Admin_Model_Resource_Acl::...


3

Problem resolved. By modifying _isAllowed() function like following protected function _isAllowed() { return true; } It's a very bad decision. In you case right way is: protected function _isAllowed() { return Mage::getSingleton('admin/session')->isAllowed('system/vendor'); }


3

Does it make sense to change the test to expect a 302 status code? Yes. The below overrides the default implementation for testAclNoAccess() and checks that a redirect happens when accessing the System Config area with insufficient permissions. public function testAclNoAccess() { $this->_objectManager->get('Magento\Framework\Acl\Builder') ...


3

I've tried your code and found an issue. You are trying to extend "Magento_Contact::contacts" resource and insert a child resource into it. But actually such a resource doesn't exist. And Magento tries to create this new resource. But it will throw an error as the resource has no "title" parameter


3

If you want to be able to use helloadmin/manage/search as an ACL entry you need to update your adminhtml.xml file, replace the following: <acl> <resources> <admin> <children> <helloadmin translate="title" module="helloadmin"> <title>Admin Theme</title> ...


3

Your "acl" tree does not match the "menu" tree. You have to copy everything below menu to acl/resources/admin/children and remove the <action> nodes. Example: In your case, that means, adminhtml.xml should look like this: <?xml version="1.0" encoding="UTF-8" ?> <config> <acl> <resources> <admin> ...


Only top voted, non community-wiki answers of a minimum length are eligible