Cannot access plugin controllers when plugin does not have a "cp section"

Question

Due to a permission check in \Craft\WebApp::processRequest(), I cannot access my plugin controller through the control panel templates. Also I cannot grant the user access because the plugin does not have a "cp section".

I have a fieldtype that loads data through an ajax-request, but this does not work if the user looking at the pages does not have access to the plugin.

Simple solution would be to always show all plugins (with controllers) in the permission overview, so that I can grant access if needed.

Answer 1

If you don't want to give the user specific access to your plugin, I think the only solution is to allow anonymous access to the controller action. But of course, this would make the controller accessible to alll anonymous users, also outside the control panel.

Answer 2

Controller actions are actually available both from the Control Panel and the front-end site. For example, EntriesController::actionSaveEntry() could be accessed from either of these locations:

• http://example.com/admin/actions/entries/saveEntry
• http://example.com/actions/entries/saveEntry

Only the first one will be considered a Control Panel URL, so it’s the only one that will enforce the “Access the CP” permission.

So in your case, if you’re calling a controller from a front-end page, you should just use the front-end version of the controller URL.

You don’t actually have to think about this stuff if you just use UrlHelper::getActionUrl():

$url = UrlHelper::getActionUrl('entries/saveEntry');

There’s also a corresponding actionUrl() function for templates:

{{ actionUrl('entries/saveEntry') }}