SOLVED
Hi, my problem is that from Magento backend, I can't create new user or modify existing admin user. The function used work before as I am have been and still in the process constructing this site using Magento CE 1.9.1. During the span of last 1-2 last months, I have created several admin users with different roles & permissions in my mangento site, this prooves that the admin "Add New User" had been working before. In the last few months, I have purchased some 3rd party modules and have them installed, amongh thoese, one is social login, and another "Open Job Manager 1.3" by FME, the later was the last module installed and then with some custom works done by the provider FME. I chat with the FME support for the problem, and was told its not related with their module. The social login module was installed before the "Open Job Manager 1.3" , and everything was working before then. FME Support guy said its possible the problem caused by " social login module. I disabled either module, problem persisits. So, currently I am unable to add new admin user from magento backend - from backend menu, going to Systems -> Permssions - Users, first it shows normal:
but when I click the "Add New User" (see screen blow), I get all blank on the left. There is no user form, and nowhere to add new user information:
Using Google chrome browser's "Inspect Element" shows error message in console log,
"Uncaught TypeError: Cannot set property 'value' of null"
pointing to line:'
$('user_user_roles').value = userRoles.toQueryString();
I know its possible to create new admin user going directly to mysql database, but I still want to get this backend page working. Can anyone please help or give me some directions? Thank you in advance!
2 ACCEPTED SOLUTIONS
Accepted Solutions
Out of curiousity, have you applied all of the latest security patches released by Magento to your site in the last 5 weeks, particularly the :
SUPEE-1533 (Remote Code Execution Vulnerabilities)
SUPEE 5344 (Shoplift Vulnerability Patches)
SUPEE 5994 (7 Remote Execution, XSS, SQL Injection Vulnerability Patches)
How about logging - do you have it enabled on your site at System > Configuraiton > Advanced > Developer > Logging
If you don't have it enabled, go enable them then open up an ssh session and navigate to the lfolder where you have Magento installaed then to the var/log/ subfolders.
<WEBROOT>/var/log/
You should see system.log and (only if a true excpetion is being thrown in the php code) an exception.log file. See the screenshots below for an example of how I used the linux tail command to view the last 50 lines of each file.:
There is likely only a few possible reasons why this view is blank:
Possibility #1) You changed the code or configuraiton accidentally (I'm assuming that you didn't but you should be using source control repositiry system like git or mercurials and you could go look at your historical change log to see if it recorded any change you forgot making that could have broken the view...but like I said I'm assuming you already did that...) and either disabled the output or introduced an error that is preventing that form from being rendered. If you introduce an error it will be displaye3d in the above system.log, exeception.log, or also displayed in the <WEBROOT>/var/report/ folder - each exception that gets thrown has a file generated in that folder that includes onl ythe exception details for that one exception.
By defaullt, the Magento index.php file in your <WEBROOT> folder has a line around #77 that looks like the following:
#ini_set('display_errors', 1);
That disales the printing of error messaes to the screen (this is normally a good idea in production). You may want to uncomment this, clear your cache, and try adding a useer again to see if you see any error displayed on the screen when you see the blank display/. If not, go hcheck your logs to see if they're displaying any errors. if so, you will probably need to resolve the errors to view that user management form again.
Possibility #2) You have been attacked and compromised. One of the attack vectors we've seen commonly was the disabling of module output in the admin console, particular relating to user managemnet because on the first thing attackers would do was add new users and they didn't want the victim to see those new users. I am not sure how likely this is since most other attacks I've seen in the wild broke a lot of other functionlaity and not just this one view, but it's serious enough that if you haven't already you should stop reading this and go install those patches linked to from above.
Possibility #3) Back aready? Ok, one other possiility is that you've disabled some module output (basically telling a module to stop printing to the screen) accdentally your self or perhaps you installed a different module and IT disabled some screen output. Or maye you disaled it on purpose earlier...in any case...
You can check which modules are setup to print out put to the screen and logs by going to System > Configuration > Advanced > Advanced > Module Output./ You should see something like the following screen. Go through all of the displayed options and make sure they are all set to enabled (if you set some to disabled on purpose, you can reset those back after you do this test, but go aehad and enable them all for the time being):
So glad I was able to help, @bamboodeck
Would you do me a favor in return and throw some kudos my way and mark the issues you originally reported as resolved? This will help anyone else who comes across the same issue know which comment they can review in order to resolve the problem themseleves (and give me a boost on my profile here 
)
Out of curiousity, have you applied all of the latest security patches released by Magento to your site in the last 5 weeks, particularly the :
SUPEE-1533 (Remote Code Execution Vulnerabilities)
SUPEE 5344 (Shoplift Vulnerability Patches)
SUPEE 5994 (7 Remote Execution, XSS, SQL Injection Vulnerability Patches)
How about logging - do you have it enabled on your site at System > Configuraiton > Advanced > Developer > Logging
If you don't have it enabled, go enable them then open up an ssh session and navigate to the lfolder where you have Magento installaed then to the var/log/ subfolders.
<WEBROOT>/var/log/
You should see system.log and (only if a true excpetion is being thrown in the php code) an exception.log file. See the screenshots below for an example of how I used the linux tail command to view the last 50 lines of each file.:
There is likely only a few possible reasons why this view is blank:
Possibility #1) You changed the code or configuraiton accidentally (I'm assuming that you didn't but you should be using source control repositiry system like git or mercurials and you could go look at your historical change log to see if it recorded any change you forgot making that could have broken the view...but like I said I'm assuming you already did that...) and either disabled the output or introduced an error that is preventing that form from being rendered. If you introduce an error it will be displaye3d in the above system.log, exeception.log, or also displayed in the <WEBROOT>/var/report/ folder - each exception that gets thrown has a file generated in that folder that includes onl ythe exception details for that one exception.
By defaullt, the Magento index.php file in your <WEBROOT> folder has a line around #77 that looks like the following:
#ini_set('display_errors', 1);
That disales the printing of error messaes to the screen (this is normally a good idea in production). You may want to uncomment this, clear your cache, and try adding a useer again to see if you see any error displayed on the screen when you see the blank display/. If not, go hcheck your logs to see if they're displaying any errors. if so, you will probably need to resolve the errors to view that user management form again.
Possibility #2) You have been attacked and compromised. One of the attack vectors we've seen commonly was the disabling of module output in the admin console, particular relating to user managemnet because on the first thing attackers would do was add new users and they didn't want the victim to see those new users. I am not sure how likely this is since most other attacks I've seen in the wild broke a lot of other functionlaity and not just this one view, but it's serious enough that if you haven't already you should stop reading this and go install those patches linked to from above.
Possibility #3) Back aready? Ok, one other possiility is that you've disabled some module output (basically telling a module to stop printing to the screen) accdentally your self or perhaps you installed a different module and IT disabled some screen output. Or maye you disaled it on purpose earlier...in any case...
You can check which modules are setup to print out put to the screen and logs by going to System > Configuration > Advanced > Advanced > Module Output./ You should see something like the following screen. Go through all of the displayed options and make sure they are all set to enabled (if you set some to disabled on purpose, you can reset those back after you do this test, but go aehad and enable them all for the time being):
So glad I was able to help, @bamboodeck
Would you do me a favor in return and throw some kudos my way and mark the issues you originally reported as resolved? This will help anyone else who comes across the same issue know which comment they can review in order to resolve the problem themseleves (and give me a boost on my profile here )
