I'm currently programming a module that contains several Ajax calls, some of them with Add / update & Delete requests in the DB. Now I am thinking about the fact that it will be necessary to check the ACL state in the functions called via Ajax in addition to the frontend check (not visible if not in the right group). Unfortunately I can't find an example how to realize this. It is supposed to be that the admin should be able to give user groups the possibility to make changes via Frontend GUI or to prevent them via the modules permissions.

But I can imagine that a simple "hide" of the options in the frontend is not enough if the function is slumbering in the background and can be called without any check by AJAX...

I've already passed the module title into the AJAX call and now I failed because the permissions don't seem to be available via

JModuleHelper::getModule('mod_modulename', $moduleTitle);

to the $module... the $user object is available via


and waits to be compared with the information according to the ACL settings of the module instance...

So, how do I get to the permission settings of the module instance to check if the user who made the ajax call is allowed to do so?

1 Answer 1


Yes you do need to check the permissions in your Ajax-handling code.

The way you would do this would be to follow the pattern in the Joomla MVC FormController, where it uses the Joomla User authorise method, eg, to check if a user can create an article:

$user = Factory::getUser();
$user->authorise('core.create', 'com_content');  

authorise() returns true or false, depending upon whether the user may perform the operation or not.

Your first parameter to authorise() is the type of action you want to check eg 'core.create' for creating, 'core.delete' for deleting, etc.

The second parameter is the asset you want to check against, and Joomla will check up the asset hierarchy from the lowest level. So for example delete permission may be set at an individual article level so you should check

$user->authorise('core.delete', 'com_content.article.' . $id);  

where $id is the id of the article.

You mention about checking against the module permissions, and you can of course do

$user->authorise('core.delete', 'com_modules.module.' . $id);  

where $id is the id of your module. But that would be checking that the user has permission to delete your module, and I'm not sure that's what you really want to check. If you're talking about operations in the database then you want to check the permissions by passing the Joomla component which 'owns' that database table.

You also may want to check that the user is allowed to 'read' your module, by comparing the Access of the module with the list of access levels that the user may see, which is returned by getAuthorisedViewLevels().

There's good ACL tutorial information available at https://docs.joomla.org/J3.x:Access_Control_List_Tutorial and in this video (between 2 mins and 32 mins is the section to watch).

  • thank you, your explanation is very good - its my own jcb component, so i can add there the acl structure without any problem and get it by the module. my plan b would be add a select in the backend for usergroups that can do x and check the user against that... that should also works right?
    – Marco
    Sep 15, 2020 at 18:12
  • Yes, but just remember that usergroups are also hierarchical, as described in those tutorials. However, I would recommend using the Joomla methods, as they really do all the hard work for you. Sep 15, 2020 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.