Magento 1.9.2.4 Admin Permission Role and Users Issue

[neha_]

Hello All,

In magento , I can create a sub-admin giving access to limited resources. But if I allow any sub-admin to create new sub-admin role and user then he is allowed to give all the access to the new sub-admin even which are not available to him.. (I mean all the module are available to him in Role Resources Tree Under add New Role, even which are not assigned to him)

For eg. : If sub admin is not having access to reports,Order he can not allow the reports,Order access to the other user he is creating from his access.

Any Suggestions.. ?

Thanks in anticipation.

[Pronto]

Magento permissions are module based. So basically if the uses have access to the module can do EVERYTHING this module does and this by the way includes permission management. What I recommend is that you either remove permission management from sub-admins completely or build a custom extension that limits what such users can do. Neither of them is a very elegant solution, but lets face it -- permission granting shouldn't be assigned to people with limited access anyway.

[neha_]

I want to customize Role Resources module tree that is showing when we add/edit a role.

I found some files that are responsible for this :

For Front End(admin) : app/design/adminhtml/default/default/template/permissions/rolesedit.php

For Backend(Functionality) : (Check this one) app/code/core/Mage/Adminhtml/Mage/Block/Permissions/Tab/Rolesedit.php

Please let me know what I can do, I need to hide some modules from this tree.

[Mukesh Tiwari]

Hi @neha_

You may get some insight from the following tutorial http://www.demacmedia.com/magento-commerce/restrict-admin-roles-in-magento/

Though it does not fulfill your requirement but you may try to customize it.

[neha23]

I already Checked it.