We’re rewarding the question askers & reputations are being recalculated! Read more.
14

You can do this from the backend. Go to System > Configuration > Customers > customer configuration > Create new account options and choose the group you want to assign to in the Default Group option This way you don't need to change any code. If you do however want to use code for some specific reason the customer_register_success event is the ...


12

Not sure if I understand your question, but it seem as you created an "admin user" and not a "customer". To get an admin user role try (assuming that user is log in) $admin_user_session = Mage::getSingleton('admin/session'); $adminuserId = $admin_user_session->getUser()->getUserId(); $role_data = Mage::getModel('admin/user')->load($adminuserId)-&...


8

After long research, I am able to resolve this problem. A mistake was in the format of XML . Initial code : <?xml version="1.0"?> <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../../../../../lib/internal/Magento/Framework/Acl/etc/acl.xsd"> <acl> <resources> <resource id="...


7

I want to explain a bit what @Sander Mangel said in his answer: make sure the Adminhtml controller of the module has a _isAllowed method Look for files like this: /app/code/community/your/module/controllers/Adminhtml/SomeController.php and make sure there's a method that looks like this inside every admin controller: protected function ...


6

_isAllowed for controllers is called when the controller action is dispatched. to see if the current user has access to that specific action. If not, a 403 page is displayed. _isAllowedAction has no specific general meaning. It is declared in just 4 blocks and it is used just in that class. It is not used in parent classes or in abstract block classes. ...


5

I don't think there is a way to remove the rss link and the export types through an observer. For example, the code that shows the export types is this: <?php if($this->getExportTypes()): ?> <td class="export a-right"> <img src="<?php echo $this->getSkinUrl('images/icon_export.gif') ?>" alt="" class="v-middle"/>&...


5

There are a couple of thinks you can check make sure the Adminhtml controller of the module has a _isAllowed method check if the path in the _isAllowed method matches you ACL in the adminhtml.xml file make sure the cache is cleared after creating the role


5

Here are main points about Magento 2 authorization system: The same acl.xml is declaring resources used for backend actions protection and web API. It means, authorization system is now unified Resulting merged acl.xml is used to build 2 identical ACL trees for managing permissions in the admin panel. One is on the admin user role edit page, another is on ...


5

You need to use DI in your class - 1. add property of AdminSession class to class 2. add including of the variable using dependensy injection: /** * @var \Magento\Backend\Model\Auth\Session */ protected $_adminSession; public function __construct( \Magento\Backend\Model\Auth\Session $adminSession ) { $this->_adminSession = $adminSession; } ...


4

This is syntax how to create the Menu in Magento Admin Panel you can follow this /app/code/local///etc/adminhtml.xml <?xml version="1.0"?> <config> <menu> <[module] module="[module]"> <title>[Module]</title> <sort_order>71</sort_order> <children> &...


4

I see three ways: The easy one: CSS Just add a new css file and hide everything you want Change the template There is a standard template which is used for every grid and its container: /app/design/adminhtml/default/default/template/widget/grid/container.phtml /app/design/adminhtml/default/default/template/widget/grid.phtml Just change the template in ...


4

May there are issue in any third partly extension. Basically adminhtml.xml define the acl permission for a module. On this xml there some code written like module="amlocator" .where amlocator is helper prefix. Example of helper : Module Mage_Catalog <global> .... <helpers> <catalog><!-- call as helper prefix or identifier of ...


4

Here we go: function copyResources($sourceRoleId, $destinationRoleId) { // Delete old resources for destination role Mage::getResourceModel('admin/rules_collection') ->addFieldToFilter('role_id', $destinationRoleId) ->walk('delete'); // Copy resources $resources = Mage::getResourceModel('admin/rules_collection') ...


4

The fastet option you have is to create a new admin and reset the previous user's permissions. You can do it from command line. Move to your Magento's root and type: php bin/magento admin:user:create \ --admin-user="mynewuser" \ --admin-password="mynewpassword" \ --admin-email="john@doe.com" \ --admin-firstname="MyName" \ --admin-...


3

What you could do is listen to the event admin_user_authenticate_after and check the ip if it matches. This event is fired when a user is authenticated in the admin login process. It has the result passed in so you should be able to check the ip and if you want to limit the access simply set the result to false and thus the authentication will fail. Mage::...


3

Here is what I did: class Mynamespace_Mymodule_Block_Adminhtml_Sales_Order_Grid extends Mage_Adminhtml_Block_Sales_Order_Grid{ protected $_idArray = array(); public function __construct() { parent::__construct(); $this->_idArray = Mage::helper('mymodule')->getUserInfo(); } public function getExportTypes(){ ...


3

Try to use admin_user_save_after. In your observer you can then retrieve the user like this: public function doSomething($observer){ $adminUser = $observer->getEvent()->getObject(); //do something with admin user } Keep in mind that this event is dispatched even when an existing user changes his password. To identify if the user is new, you ...


3

Shoplift bug activity => http://magento.com/security-patch Some reported activities such as: Check your list of administrator users for unknown accounts. We have seen vpwq and defaultmanager being used, but any unknown account is suspicious Check server access log files for request POST /index.php/admin/Cms_Wysiwyg/directive/index/ coming from unknown IP ...


3

That means, you either have an explicit call to Mage::helper('amlocator') somewhere but the "amlocator" module does not exist or does not define a helper namespace, or try to translate something within the scope of the "amlocator" module, but this module does not define a helper namespace


3

This is a really good idea and I would use such a module. I won't write the code for you, but here are some thoughts and pointers. unfortunately it is possible that an attacker creates an admin account without triggering the event. The shoplift exploit used SQL injection to get access to the database, then create an admin account there. I would suggest a ...


3

This is taken directly from Inchoo http://inchoo.net/magento/configure-magento-rest-and-oauth-settings/ per BOOMER's comment about posting the answer. I give them full credit for this answer. 1. Creating oAuth Consumer Since Magento REST service is working only with oAuth authentication, we need to create oAuth consumer application first. Navigate to ...


3

Note:- Use mysqldump to back up your database before doing anything further, As it will change the database values and will not be recoverable. Run this sql command to reset role with id 1 to all permissions: REPLACE INTO `authorization_rule` (`rule_id`, `role_id`, `resource_id`, `privileges`, `permission`) VALUES (1, 1, 'Magento_Backend::all', NULL, ...


3

Here we create admin user role programmatically by custom module installer with specific resources. First you need to create a installer file name InstallData.php in our custom module Setup folder complete path: app/code/ModuleNameSpace/YourModuleName/Setup <?php namespace ModuleNameSpace\YourModuleName\Setup; use Magento\Framework\...


3

try below code: $roleName = "Administrators"; $objectManager = \Magento\Framework\App\ObjectManager::getInstance(); $roleModel = $objectManager->create('Magento\Authorization\Model\Role'); $userModel = $objectManager->create('Magento\User\Model\User'); $roleModel = $roleModel->load($roleName, 'role_name'); if($roleModel->getId()) { $userIds ...


3

If you are talking about attribute when editing products read here: Read-Only Product Backend attribute Edit: to make based on usesr permissions you can try this: create custom module add new ACL permission in adminhtml.xml <?xml version="1.0" encoding="UTF-8"?> <config> <acl> <resources> <admin> ...


3

Use below code: //get the admin session Mage::getSingleton('core/session', array('name'=>'adminhtml')); //verify if the user is logged in to the backend if(Mage::getSingleton('admin/session')->isLoggedIn()){ //do stuff } else { echo "go away bad boy"; }


2

TL;DR: no it is not possible to assign more than one role The database tables admin_* look like this is possible. There are rules in admin_rule, users in admin_users and a tree in admin_role |-- Administrator (role name) | |-- John Doe (user) | +-- Martha Example (user) +-- CMS Manager (role name) |-- user 3 +-- user 4 So theoretically ...


2

Create your own controller replacing Mage_Adminhtml_Sales_OrderController. In your controller, create an _isAllowed method: /** * Acl check for admin * * @return bool */ protected function _isAllowed() { $action = strtolower($this->getRequest()->getActionName()); $aclResource = null; switch ($action) { case 'addressSave': ...


2

Whatever you do, do not delete the Magento stock Admin User account, much irritation ensues. As you're finding, messing with its Role ACL also has future repercussions. The usual method is to use a script to create a new admin account with full access so you can repair the old account and reset the ACL to All. I don't plan on plagiarizing work done by ...


2

You will need to create another role which encompasses the permissions of the 3 roles combines, a user can't have multiple roles.


Only top voted, non community-wiki answers of a minimum length are eligible