86

After installing the SUPEE-6285 patch on our Magento 1.7.0.2 store the system is showing an "Access Denied" error when attempting to access all custom modules for users who have selective permissions (not all permissions). Screenshot below.

enter image description here

The user permissions are properly set in Role Resources and we have re-applied the permission settings to ensure these are set.

The problem has been reproduced across multiple custom extensions so it isn't just a single extension that isn't working.

I have logged out/in, cleared the cache and confirmed that the compiler is disabled.

Can anyone suggest how to troubleshoot this?

David Verholen
  • 6,312
  • 1
  • 20
  • 38
Chris
  • 1,389
  • 2
  • 15
  • 25

2 Answers2

131

As written here:

If you use restricted admin accounts, some menus of third party extensions might not work anymore for them. The reason is that the default return value of Mage_Adminhtml_Controller_Action::_isAllowed() has been changed from true to Mage::getSingleton('admin/session')->isAllowed('admin'). Extensions that do not override this method in their admin controllers because they don't use the ACL, now need the "ALL" privilege.

The only solution is to patch the extensions and add this method to all their admin controllers:

protected function _isAllowed()
{
    return true;
}

Or if they actually have an ACL resource defined in etc/adminhtml.xml:

protected function _isAllowed()
{
    return Mage::getSingleton('admin/session')->isAllowed('ENTER RESOURCE IDENTIFIER HERE');
}

How to determine the resource identifier

This is how an adminhtml.xml might look like:

Mage_Setup example (acl)

Take the node names below acl/resources/admin/children, skipping following children nodes.

How to create missing resource identifiers

If there is only a <menu> definition but no <acl> definition, you can also define your own (it does not have to be within the same module, so no 3rd party files have to be modified)::

Mage_Setup example (menu)

Copy everything below menu to acl/resources/admin/children and remove the <action> nodes.

Automatic fix

There is a good command line tool by SupportDesk.nu at https://gist.github.com/raybogman/eec47237b8ef0d4dd0fd

It handles most missing _isAllowed() calls quite well but will result in broken code with obfuscated or encrypted source files, so you still should check the results manually.

Community
  • 1
Fabian Schmengler
  • 65,791
  • 25
  • 187
  • 421
  • Just tested this solution, and giving the "Dashboard" permission makes no difference. Is the "Dashboard privilege" the same as the "Dashboard" permission under Role Resources or is this somewhere else? – Chris Jul 08 '15 at 13:26
  • 2
    Updated the answer, I misinterpreted the configuration for admin, it actually only returns true for users with all privilieges. – Fabian Schmengler Jul 08 '15 at 14:06
  • 3
    Please do not just do return true; if there is nothing defined for ACL in your config.xml or adminhtml.xml. Instead add the permissions to the xml file and check it properly. Take a look Alan Storm's site or here for info on creating permissions. – kel Jul 09 '15 at 16:53
  • It is working fine for custom module but if there is section for configuration setting, how can we gives access for this block? – mjdevloper Jul 13 '15 at 08:15
  • It follows the menu structure in the same way: acl/resources/admin/children/system/children/config/children/SECTION, where SECTION is the node name used in system.xml – Fabian Schmengler Jul 13 '15 at 08:22
  • @fschmengler what and all are "admin controllers:" in magento – Baby in Magento Oct 09 '15 at 10:16
  • 1
    Controllers for routes that are configued with <use>admin</use>. They usually extend Mage_Adminhtml_Controller_Action. – Fabian Schmengler Oct 09 '15 at 10:18
  • In above example, you have got two nodes, how do I define these in my _isAllowed() function? I can only call one node there right? – Adarsh Khatri Jan 22 '16 at 02:32
  • That's what you usally do, but if you want you can also require both (Mage::getSingleton('admin/session')->isAllowed('...') && Mage::getSingleton('admin/session')->isAllowed('...')) or one of both (Mage::getSingleton('admin/session')->isAllowed('...') || Mage::getSingleton('admin/session')->isAllowed('...')) – Fabian Schmengler Jan 22 '16 at 06:53
  • ^In that situation, can you get the parameter to $x in isAllowed($x) dynamically based on the page request? – Nick Rolando Aug 26 '16 at 20:03
2

In my case for third party modules, adding below code to the adminhtml controllers worked:

protected function _isAllowed()

{
     return true;
}
Ankur Jain
  • 65
  • 1
  • 1
  • 8