Category: 小小草

A third party Adwords professional requested a read only access to Magento admin panel, which raised the question to me: how to create a Magento admin panel user with read only privilege?

I am keen to do this job via ACL. Magento ACL role resources start from module to controller to action, I can not differentiate read/write privilege at the root level of role resources. It means it involves a lot of hassle coding up ACL in adminhtml.xml when creating a role with read access to all modules, because I have to code for every action, for example, indexAction is a read role resource, saveAction is a write role resource, editAction can be a write role resource if it actually saves data itself, or be a read role resource if post data are posted to saveAction.

Luckily, in my case, the Adwords professional only requested access to two modules – Catalog and Reports. As for Reports module, I treat the whole module as read only, so I simple check “Reports” node in the role resources tree.

As for Catalog module, the Adwords professional only requested to view product list, so I create several children of “Manage Products” node. The children map to all actions in Mage_Adminhtml_Catalog_ProductController, for example, product list maps to indexAction, product detail maps to editAction, product add and update maps to saveAction. I check indexAction node. I could check editAction (because it is read only process) as well but the Adwords professional did not see its necessity.

The last thing left to do is differentiating privilege by role resources node. It is a very simple change – override Mage_Adminhtml_Catalog_ProductController’s _isAllowed() method from

protected function _isAllowed()
{
	return Mage::getSingleton('admin/session')->isAllowed('catalog/products');
}

to

protected function _isAllowed()
{
	$action = $this->getRequest()->getRequestedActionName();
	return Mage::getSingleton('admin/session')->isAllowed('catalog/products/'.$action);
}

I think there may be another to differentiate read and write role resource using ACL, because when I look at a sample adminhtml.xml file, it says

	<acl>
		<resources>
			<all>
				<title>Allow Everything</title>
			</all>
		</resources>
	</acl>

What does it means? Does it imply I can do something like

	<acl>
		<resources>
			<read>
				<title>Read only</title>
			</read>
			<write>
				<title>Read and write</title>
			</write>
		</resources>
	</acl>

?

Magento 1.5.0.0 各测试版的发布很紧密，我有些应接不暇。新功能来不及去试，倒发现一个老功能不灵光了，就是 Magento admin panel 里显示来自官方的 notifications 的 “Go to messages index” 的链接地址不正确，点了仍是当前页面。

因为我有个 fpcp 模块改动了一些 global messages 和 messages 的显示逻辑，是基于 Magento 1.4.2.0 开发的，一开始我还以为是我的改动与 1.5.0.0 不兼容。但我把 fpcp 整个 disable，”Go to messages index” 也同样不工作，这下我才想到是 Magento 1.5.0.0 bug。

还没来得及 report bug to Magento，我又发现 Magento 1.5.0.0 rc1 版已经修正了这个 bug。去看了 release notes，果然提到 Fixed “Go to notifications” link works improperly。

About a year ago, I noticed some category or product attributes, for example, sku, path, etc., were given backend type “static” in class Mage_Catalog_Model_Resource_Eav_Mysql4_Setup. But I failed to find out what static meant here, or I did not know what the difference was between static and datetime/decimal/int/text/varchar. All I knew at that time was if I gave my user defined attribute a “static” type, the attribute values were stored in _varchar table.

Recently, I dived deeper into Magento EAV module. Now I can answer my question.

An entity can have some “static” attributes, whose values are stored in entity main table. Take sku for example, sku values are stored in catalog_product_entity table. Although sku is varchar type, its values are not stored in catalog_product_entity_varchar. Magento does not lookup catalog_product_entity_varchar for sku values because in eav_attribute table, sku backend type is defined as “static”.

It also explains why I can get sku values without add it to select, but I can not do the same with non static attributes.

$collection = Mage::getModel('catalog/product')->getCollection();
echo $collection->getFirstItem()->getSku();

It will output the sku.

$collection = Mage::getModel('catalog/product')->getCollection();
echo $collection->getFirstItem()->getName();

It will not output the name.

$collection = Mage::getModel('catalog/product')->getCollection()->addAttributeToSelect('name');
echo $collection->getFirstItem()->getName();

Calling addAttributeToSelect is a must to retrieve non static attribute values.

For user defined attributes of existing entity, if I do not change the structure of main entity table, even I specify backend as “static” in entity setup class, Magento has nowhere to store their values to but fallback to _varchar table.

I got some complaints to my bxgy module about reminder message is not showing in shopping cart as it supposed to be. But I checked over and over on my machine and did not find anything preventing reminder message being shown.

By a chance I realise maybe those people changed Magento interface and theme in a not nice way. What is a nice way? By my definition, any extension or change to Magento original code should make sure

• do as few changes as possible
• Magento default theme can always be fallen back to

I take it as a basic requirement of customisation, but I can not guarantee everyone else see it through. If I rely on a module layout xml file to trigger an action against a specific route, I get a higher chance of my layout xml file being bypassed by some incompatible theme.

In bxgy module version 0.1.0 to 0.1.1, I wrote a layout handle checkout_cart_index in bxgy.xml, which is expected to add a message to the message block against route checkout/cart/index. If bxgy.xml is bypassed (when the theme settings do not take default theme fallback into consideration), nothing will happen. Do I have to use layout xml file to trigger an action against a specific route? Absolutely not. There are many ways around.

In a newer version of bxgy module, I use an event observer to trigger “controller_action_postdispatch_checkout_cart_index” event, and add message to the message block in this observer. Because adding reminder message is something more relevant to functionality than presentation, the code’s logic is better if it is moved from design folder to app folder. And event observer is independent of theme settings.

BTW, I finished coding this new version of bxgy, but I want to put together some other modules before release it.

$this->getUrl($route) can be used in templates to generate an absolute URL based on route, but it only works for frontend URLs. As for adminhtml URLs, unless you say No to “Add Secret Key to URLs” in System >> Configuration >> Admin, a valid adminhtml URL should have a secret key.

$this->getUrl($route, $params) can take ‘_current’ as one of parameters, but it only attaches current URL’s parameters. Adminhtml URL secret keys vary with controller and action names. So how to get unique secret key by controller and action names? Easy peasy, just use:

Mage::getSingleton('adminhtml/url')->getSecretKey($controllerName, $actionName);

How to get URL to adminhtml route (attach the secret key automatically if it is enabled)? Just use:

Mage::helper('adminhtml')->getUrl($route);