Permissions and the user token

The admin panel is used by several people: an owner, a manager, a content editor. Each staff member belongs to a user group, and the group defines which pages can be opened and which can change data. Besides that, every admin address carries a secret token. Your controller must respect both.

User groups

Groups are edited in System → Users → User Groups. Each group has two lists of routes:

List	What it allows
Access Permission	Opening the page
Modify Permission	Saving, deleting, installing

A route in these lists is the path of the controller: extension/acme_hello/module/acme_hello.

The access permission is checked by the engine itself when the page is opened. The modify permission is checked by your code.

Checking modify

Add the check to the save() method from the previous lesson:

// extension/acme_hello/admin/controller/module/acme_hello.php
public function save(): void
{
    $this->load->language('extension/acme_hello/module/acme_hello');
 
    $json = [];
 
    if (!$this->user->hasPermission('modify', 'extension/acme_hello/module/acme_hello')) {
        $json['error'] = $this->language->get('error_permission');
    }
 
    if (!$json) {
        $this->load->model('setting/setting');
 
        $this->model_setting_setting->editSetting('module_acme_hello', $this->request->post);
 
        $json['success'] = $this->language->get('text_success');
    }
 
    $this->response->addHeader('Content-Type: application/json');
    $this->response->setOutput(json_encode($json));
}

Remove the route from the Modify Permission list of your group and press save on the settings page — a red message with the text of error_permission appears and nothing is saved.

The user object

$this->user is the logged-in staff member. It exists only in the admin panel.

Method	What it returns
`isLogged()`	Whether the staff member is logged in
`getId()`	Id of the staff member
`getUserName()`	Login
`getGroupId()`	Id of the user group
`hasPermission($type, $route)`	Whether the group has the permission

The user token

After login the panel creates a random string and stores it in the session. Every address of the panel must contain it:

admin/index.php?route=extension/acme_hello/module/acme_hello&user_token=3f9a...

A request without the token or with a wrong one is sent to the login page. This protects from request forgery: another site cannot make a staff member's browser call an admin address, because it does not know the token.

So every link built in an admin controller includes the token:

$token = 'user_token=' . $this->session->data['user_token'];
 
$data['back'] = $this->url->link('marketplace/extension', $token . '&type=module');

Common mistake

A second controller is added to an installed extension, for example extension/acme_hello/admin/controller/module/callback.php, and its page answers «Permission Denied». Permissions are given during installation only for the routes that existed then. Open System → Users → User Groups, edit your group and tick the new route in both lists.

Thanks for reading!