User Roles and Permissions

Overview

OpenCart uses User Groups to control admin panel access. Each user group defines:

• Access permissions: Which pages/features users can view
• Modify permissions: Which pages/features users can edit/delete

This allows you to:

• Limit staff access to specific areas
• Prevent accidental changes to critical settings
• Create role-based access control (RBAC)
• Maintain security and accountability

Understanding User Groups

Default User Groups

OpenCart includes one default group:

Administrator (ID: 1)

• Full access to all features
• Can view and modify everything
• No restrictions

Best Practice: Create custom groups instead of giving everyone Administrator access.

User Group Structure

Each user group has two permission sets:

1. Access Permission

   • Controls which pages user can VIEW
   • User sees menu items and can open pages
   • Cannot make changes without Modify permission

2. Modify Permission

   • Controls which pages user can EDIT/DELETE
   • Requires Access permission to be effective
   • Enables Save, Delete, and other action buttons

Example:

• Access: catalog/product → User can view product list
• Modify: catalog/product → User can add/edit/delete products

Managing User Groups

Viewing User Groups

Admin Panel > System > Users > User Groups

Displays:

• User Group Name
• Actions (Edit, Delete)

Adding User Groups

1. Navigate to User Groups

   Admin Panel > System > Users > User Groups
   

2. Click Add New

   • Click blue + button (top-right)

3. Enter Group Name

   • User Group Name: Descriptive name (e.g., "Product Manager", "Order Processor")

4. Set Access Permissions

   Scroll through the Access Permission list and check pages the group should VIEW:

   Common Permission Patterns:

   Product Manager:

   • catalog/product
   • catalog/category
   • catalog/manufacturer
   • catalog/option
   • catalog/attribute
   • sale/order (view only)

   Order Processor:

   • sale/order
   • sale/return
   • customer/customer (view only)
   • report/sale_order

   Marketing Manager:

   • marketing/marketing
   • marketing/coupon
   • design/banner
   • design/seo_url
   • extension/module

   Content Editor:

   • catalog/information
   • design/layout
   • design/banner
   • design/seo_url

5. Set Modify Permissions

   Check pages where the group can MAKE CHANGES:

   Note: Only include permissions where editing is needed. For view-only access, check only Access permission.

6. Save User Group

   • Click Save button

Editing User Groups

1. Navigate to User Groups

   Admin Panel > System > Users > User Groups
   

2. Click Edit (pencil icon)

3. Modify Permissions

   • Add or remove permissions as needed
   • Click Save

Warning: Removing permissions from a group in use will immediately affect all users in that group.

Deleting User Groups

Admin Panel > System > Users > User Groups
Select user group (checkbox)
Click Delete (trash icon)
Confirm deletion

Note: Cannot delete a user group that has users assigned to it. Reassign users first.

Common Permission Patterns

Full Product Management

Access:

• catalog/product
• catalog/category
• catalog/manufacturer
• catalog/attribute
• catalog/attribute_group
• catalog/option
• catalog/review
• catalog/download
• catalog/filter
• tool/upload

Modify:

• All of the above

Order Management Only

Access:

• sale/order
• sale/order_status
• sale/return
• customer/customer (view customer details)
• report/sale_order
• report/sale_return

Modify:

• sale/order (change status, add history)
• sale/return (process returns)

Marketing & SEO

Access:

• marketing/marketing
• marketing/coupon
• marketing/contact
• design/banner
• design/seo_url
• catalog/product (view products)
• catalog/category (view categories)
• extension/module
• extension/total

Modify:

• marketing/marketing
• marketing/coupon
• marketing/contact
• design/banner
• design/seo_url
• extension/module

Customer Service

Access:

• sale/order (view orders)
• sale/return
• customer/customer
• customer/customer_group
• customer/customer_approval
• marketing/contact
• report/customer_order
• report/customer_activity

Modify:

• sale/return
• customer/customer (edit customer details)
• marketing/contact

Store Manager (Almost Full Access)

Access:

• All catalog/, sale/, customer/, marketing/, design/*
• Most report/*
• Some extension/* (modules, shipping, payment)

Modify:

• Most of the above
• Exclude: System settings, user management, modifications

Do NOT give access to:

• setting/setting (store settings)
• user/* (user management)
• design/modification (OCMOD)
• extension/installer (extension upload)
• marketplace/api

Read-Only Reporting

Access:

• All report/*
• sale/order (view only)
• customer/customer (view only)
• catalog/product (view only)

Modify:

• None (read-only)

Permission Paths Reference

Catalog Permissions

catalog/product              Product management
catalog/category             Category management
catalog/manufacturer         Manufacturer/brand management
catalog/option               Product options
catalog/attribute            Product attributes
catalog/attribute_group      Attribute groups
catalog/review               Product reviews
catalog/information          Information pages (About Us, etc.)
catalog/download             Digital downloads
catalog/filter               Product filters
catalog/recurring            Recurring profiles

Sales Permissions

sale/order                   Order management
sale/order_status            Order statuses
sale/return                  Returns/RMA
sale/voucher                 Gift vouchers
sale/voucher_theme           Voucher themes
sale/recurring               Recurring payments

Customer Permissions

customer/customer            Customer management
customer/customer_group      Customer groups
customer/customer_approval   Approve new customers
customer/custom_field        Custom fields

Marketing Permissions

marketing/marketing          Marketing/campaigns
marketing/coupon             Discount coupons
marketing/contact            Contact/newsletter
marketing/affiliate          Affiliate management

Design Permissions

design/layout                Page layouts
design/banner                Banners
design/theme                 Theme editor
design/translation           Language editor
design/seo_url               SEO URLs

System Permissions

setting/setting              Store settings (CRITICAL)
setting/store                Multi-store management
setting/event                Events

User Management Permissions

user/user                    Admin users (CRITICAL)
user/user_group              User groups (CRITICAL)
user/api                     API users

Extension Permissions

extension/extension          Extension management
extension/installer          Extension upload (CRITICAL)
extension/modification       OCMOD management (CRITICAL)
extension/module             Module settings
extension/shipping           Shipping methods
extension/payment            Payment methods
extension/total              Order totals
extension/analytics          Analytics extensions

Reports Permissions

report/sale_order            Sales reports
report/sale_tax              Tax reports
report/sale_shipping         Shipping reports
report/sale_return           Returns reports
report/sale_coupon           Coupon reports
report/product_viewed        Product views
report/product_purchased     Product purchases
report/customer_order        Customer orders
report/customer_activity     Customer activity
report/customer_search       Customer searches
report/online                Online customers

Tools Permissions

tool/upload                  File uploads
tool/backup                  Backup/restore (CRITICAL)
tool/log                     Error logs

Creating Custom Roles

Example: Content Writer

Purpose: Add/edit blog posts and info pages only

1. Create User Group

   • Name: "Content Writer"

2. Access Permissions:

   catalog/information
   design/seo_url
   tool/upload (for images)
   

3. Modify Permissions:

   catalog/information
   design/seo_url
   tool/upload
   

Example: Inventory Manager

Purpose: Update stock levels and prices only

1. Create User Group

   • Name: "Inventory Manager"

2. Access Permissions:

   catalog/product
   catalog/category (view only)
   catalog/manufacturer (view only)
   report/product_purchased
   report/stock
   

3. Modify Permissions:

   catalog/product (price, quantity, status only)
   

Limitation: OpenCart doesn't support field-level permissions. User can edit all product fields if they have modify permission.

Workaround: Create custom extension to limit specific field editing.

Example: Junior Developer

Purpose: Install extensions and modify themes (but not core settings)

1. Create User Group

   • Name: "Junior Developer"

2. Access Permissions:

   extension/extension
   extension/module
   design/*
   catalog/* (view products/categories)
   

3. Modify Permissions:

   extension/module
   design/layout
   design/banner
   design/theme
   

Do NOT give:

• extension/installer (can't upload new extensions)
• extension/modification (can't modify OCMODs)
• setting/setting (can't change store settings)

Assigning Users to Groups

When Creating New User

Admin Panel > System > Users > Users > Add New

User Group: Select from dropdown
Fill in other details
Save

Changing Existing User's Group

Admin Panel > System > Users > Users > Edit

User Group: Change selection
Save

Result: User immediately gets new permissions on next page load.

Testing Permissions

Test User Access

1. Create test user with new user group

2. Log in as test user (use different browser or incognito)

3. Verify:

   • Can access permitted pages
   • Cannot access restricted pages (404 or permission error)
   • Can modify where permitted
   • Cannot modify where restricted

Permission Denied Error

When user tries to access restricted page:

Warning: You do not have permission to access this page, please refer to your system administrator.

Causes:

• User group lacks Access permission for that path
• User status is Disabled
• User logged out (session expired)

Advanced Permission Management

Database-Level Permissions

User group permissions stored in:

Table: oc_user_group

Columns:

• user_group_id: Primary key
• name: Group name
• permission: Serialized array of access/modify permissions

View permissions:

SELECT
    user_group_id,
    name,
    permission
FROM oc_user_group;

Example permission data:

a:2:{
  s:6:"access";a:10:{
    i:0;s:15:"catalog/product";
    i:1;s:16:"catalog/category";
    // ... more paths
  }
  s:6:"modify";a:5:{
    i:0;s:15:"catalog/product";
    i:1;s:16:"catalog/category";
    // ... more paths
  }
}

Programmatic Permission Check

Extensions can check permissions:

File: admin/controller/extension/module/my_module.php

<?php
class ControllerExtensionModuleMyModule extends Controller {
    public function index() {
        // Check if user has access
        if (!$this->user->hasPermission('access', 'extension/module/my_module')) {
            $this->response->redirect($this->url->link('error/permission'));
        }

        // Check if user can modify
        if (!$this->user->hasPermission('modify', 'extension/module/my_module')) {
            // Show view-only interface
            $data['can_edit'] = false;
        } else {
            $data['can_edit'] = true;
        }

        // ... rest of controller
    }

    public function save() {
        // Always check modify permission for save actions
        if (!$this->user->hasPermission('modify', 'extension/module/my_module')) {
            $this->error['warning'] = 'You do not have permission to modify!';
            return;
        }

        // Proceed with save
    }
}

Custom Permission Checks

Create helper function:

File: system/library/cart/user.php (extend existing User class)

Or create new library:

File: system/library/permission_helper.php

<?php
class PermissionHelper {
    private $user;

    public function __construct($user) {
        $this->user = $user;
    }

    public function canViewProducts() {
        return $this->user->hasPermission('access', 'catalog/product');
    }

    public function canEditProducts() {
        return $this->user->hasPermission('modify', 'catalog/product');
    }

    public function canProcessOrders() {
        return $this->user->hasPermission('modify', 'sale/order');
    }

    public function canManageUsers() {
        return $this->user->hasPermission('access', 'user/user') &&
               $this->user->hasPermission('modify', 'user/user');
    }

    public function isAdministrator() {
        return $this->user->getGroupId() == 1;
    }
}

Security Best Practices

Principle of Least Privilege

• Give users only permissions they need
• Start restrictive, add permissions as needed
• Review permissions quarterly

Critical Permissions

Never give to non-administrators:

• setting/setting - Store configuration
• user/user - User management
• user/user_group - Permission management
• extension/installer - Extension uploads
• extension/modification - OCMOD management
• tool/backup - Database access

Audit User Actions

Enable activity logging:

System > Settings > Edit > Server tab
Use Compression: Enable

View user activity:

System > Users > User Activity

Regular Permission Reviews

Monthly:

1. Review active users and their groups
2. Disable inactive users
3. Update permissions for role changes

Quarterly:

1. Audit all user groups
2. Remove unnecessary permissions
3. Update for new features/extensions

Separation of Duties

Don't combine these permissions in one role:

• Financial settings + Order processing
• User management + Regular operations
• Extension installation + Content editing

Troubleshooting

User Can't See Menu Items

Cause: Lacks Access permission

Solution:

1. Find user's group
2. Edit user group
3. Add Access permission for missing path
4. User must re-login to see changes

User Can See Page But Can't Save

Cause: Has Access but not Modify permission

Solution:

1. Edit user group
2. Add Modify permission for that path
3. Save

Permission Denied Despite Correct Settings

Causes:

1. Cache Issue

   • Clear browser cache
   • User re-login

2. Session Expired

   • User re-login

3. Database Corruption

   SELECT * FROM oc_user_group WHERE user_group_id = X;
   

   Verify permission data is not corrupted

4. Extension Override

   • Some extensions modify permission checks
   • Disable recently installed extensions

Can't Delete User Group

Cause: Users are assigned to that group

Solution:

1. Find users in that group:

   SELECT user_id, username FROM oc_user WHERE user_group_id = X;
   

2. Reassign users to different group
3. Delete empty group

Next Steps

• Add and Remove Users
• Two-Factor Authentication Setup
• Audit Log Configuration

Additional Resources

• OpenCart User Management
• OpenCart Security Guidelines
• RBAC Best Practices
• OpenCart Extension Development