Due to a permission check in \Craft\WebApp::processRequest(), I cannot access my plugin controller through the control panel templates. Also I cannot grant the user access because the plugin does not have a "cp section".

I have a fieldtype that loads data through an ajax-request, but this does not work if the user looking at the pages does not have access to the plugin.

Simple solution would be to always show all plugins (with controllers) in the permission overview, so that I can grant access if needed.

2 Answers 2


If you don't want to give the user specific access to your plugin, I think the only solution is to allow anonymous access to the controller action. But of course, this would make the controller accessible to alll anonymous users, also outside the control panel.

  • Even if you allow anonymous access, you can still have custom permission logic in your controller action to decide who to let through.
    – Brad Bell
    Commented Oct 31, 2014 at 17:16

Controller actions are actually available both from the Control Panel and the front-end site. For example, EntriesController::actionSaveEntry() could be accessed from either of these locations:

Only the first one will be considered a Control Panel URL, so it’s the only one that will enforce the “Access the CP” permission.

So in your case, if you’re calling a controller from a front-end page, you should just use the front-end version of the controller URL.

You don’t actually have to think about this stuff if you just use UrlHelper::getActionUrl():

$url = UrlHelper::getActionUrl('entries/saveEntry');

There’s also a corresponding actionUrl() function for templates:

{{ actionUrl('entries/saveEntry') }}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.