Access Denied after applying Magento SUPEE 6285

Question

I recently applied Magento patch SUPEE-6285 and now I am having some permissions issues for non-admin users. Certain sections of the admin were accessible to limited users that are no longer accessible. If I look at the role resources for the role I see that the section is enabled and, when logged into that role I see the menu option, but if I pick it I get Access Denied. The 3 extensions I know of so far that are giving me trouble are

1. Commerce Themes - Guess To Registered Customer
   • They add "Manage Guest To Reg" under the "Customers" menu
2. Adjustware - Abandoned Cart Alerts
   • They add menu items under Newsletter
3. Adjustware - Review Reminders
   • They add menu items under Newsletter

I'm sure there are other extensions with similar problems, and it's likely due to how they implemented their admin pages, but I haven't been able to figure it out yet. Anyone have a fix?

UPDATE I tried changing how the router was defined, but it didn't help.

WAS:

<admin>
    <routers>
        <GuestToReg>
            <use>admin</use>
            <args>
                <module>CommerceThemes_GuestToReg</module>
                <frontName>GuestToReg</frontName>
            </args>
        </GuestToReg>
    </routers>
</admin>

CHANGED TO:

<admin>
    <routers>
        <adminhtml>
            <args>
                <modules>
                    <GuestToReg after="Mage_Adminhtml">CommerceThemes_GuestToReg_Adminhtml</GuestToReg>
                </modules>
            </args>
        </adminhtml>
    </routers>
</admin>

Answer 1

Thanks to Ron V I was able to find the full answer that enables the menu only for those with permission.

Given the following adminhtml.xml file:

<config>
    <acl>
        <resources>
            <admin>
                <children>
                    <path_to>
                        <children>
                            <acl_resource>
                                <title>My ACL Resource</title>
                            </acl_resource>
                        </children>
                    </path_to>
                </children>
            </admin>
        </resources>
    </acl>
</config>

You can extract the resource path to pass to isAllowed() to determine if this menu should be shown to this user.

protected function _isAllowed(){
    return Mage::getSingleton('admin/session')->isAllowed('path_to/acl_resource');
}

Answer 2

You can see a complete explication and resolution of this problem in the next link: Solution to the problem of permissions for non-administrators in modules after applying the patch 6285_CE_1.9.1.1 or upgrade to Magento 1.9.2.

When we update / patch our Magento installation, it applies a small change in the way Magento behaves regarding modules. Previously, Magento responded by default as true to _isAllowed() method of the controller module if that function does not exist. In version 1.9.2 or when we patch a previous version, it no longer behaves this way, so users without administrator access have not access to the installed modules.

To recover access to the module by non-administrators, we simply add the function to the corresponding controller.

protected function _isAllowed() 
{ 
return true; 
}

Answer 3

BrianVPS gets at the gist of the 'best practices' answer, but that exact snippet, of course, needs to be modified for each module and/or controller based on the intended use.

Some modules do not have a specific permission for their page, in which case - barring adding a new permission path to the acl yourself, your only option is to return true.

However, if an acl permission path does exist and is in use (which they often are to determine if the page is drawn in the admin menu bar), you have to locate that permission path and replace the example string in the isAllowed function.

For example, in the CommerceThemes/GuestToReg code, under etc/adminhtml.xml you can find the defined acl paths.

<acl>
    <resources>
        <admin>
            <children>
                <customer>
                    <children>
                        <guesttoreg_adminform>

Based on these paths, the proper permission to set access to the page should be:

protected function _isAllowed() {
    return Mage::getSingleton('admin/session')->isAllowed('customer/guesttoreg_adminform');
}

placed in the admin controller file: app/code/local/CommerceThemes/GuestToReg/controllers/Adminhtml/GuestToRegFormController.php

Answer 4

I just put the following code in the controller of the extension causing the problem:

protected function _isAllowed(){ 
  return true; 
}

The update requires extensions with scripts in Adminhtml to be more secure.