403 on ajax call (admin backend)

[hellsanos]

Hi there

Following issue:
When I am browsing as a backend user to Products > Catalog, select an item and click on the 'Default' dropdown (it says 'start typing to search template') for searching for attribute sets, I am getting a 403 forbidden status from the post method

http://example.com/admin_asdf/catalog/product/suggestAttributeSets/?isAjax=true

This error only occures when I am logged in as a user who has a "Custom" Role Resource Access.
Users whose Role Resource is set to "All" work as intended.

We kind of have to setup different user roles/settings for the backend for our clients.

Any ideas?

EDIT
Added image below

[hellsanos]

Okay...

So far I figured out that custom set user roles have no permission set for Magento_Backend::admin. If I set the value manually to allow on the database it works as intended.

I haven't figured out yet where and why this happens and I don't think that this workaround is the way to go...

This seems to be a bug.

Would be glad for some help.

[vduglued]

I have just encountered this problem too. Fixed by changing to Administrator role.

[antonkril]

The action requires specific admin resource or Magento_Catalog::products

[katmoon]

Hi @hellsanos

Product page in Admin has been completely reworked and the issue can't be reproduced anymore.
So your issue should be fixed after you upgrade Magento to the latest version.

Nonetheless, I have noticed several other similar issues with a forbidden ajax call for a custom admin role with custom, but all, permissions.

Thank you very much. This is a very good find!

Thanks,
Kateryna.

[heldchen]

@katmoon do you have a fix for the forbidden ajax call with custom roles? getting the 403 error in v2.0.4 for a user who has only Products/* and Stores/Attributes/* enabled in Role Resources.

[katmoon]

Hi @heldchen
The issue is not reproducible in 2.1, so there's no special fix for it. However you can try this fix c3e3a07 , it can help.

Thanks,
Kateryna.

[heldchen]

thanks @katmoon , that seems to work.