In my custom component, I'd like to be able to restrict specific views to only certain usergroups. If I create a menu item for one of my views, that's pretty easy to do: I just select the access level for that menu item and I'm done.

Now, the problem comes if someone tries to access directly an URL with option=com_mycomponent, or any of the internal redirections of my component goes to a page with no assigned Itemid... in that case, it's the component itself the one that needs to check the user group and determine if it's able to view that page... how can I restrict that in my code? Just a simple hardcoded check for user's usergroup? Or there's a "standard" way for doing it?

I've been checking documentation, and have found this:


but that's for what user can do, not for what user can see. I've also found this forum thread:


the code at the beginning is quite old, but at the end it's recommended to use this:


How should I proceed for that? Should I define assets for main object generated by my view so I can test access for it with JUser?

Thanks in advance.


You can create a system plugin to handle all the request to your custom component before sending control to the component.

Use onAfterRoute event to perform all the access checking.

function onAfterRoute()
  $user = JFactory::getUser();
  $groups = $user->groups;

  $jinput = JFactory::getApplication()->input;
  $option = $jinput->get('option', '');
  $view   = $jinput->get('view', '');

  // place USER-GROUP related checking here
  • Hmmm... interesting approach. Sounds cleaner, and you'd put all the logic in a specific place. I guess this will be a bit "worse" in performance terms than doing it directly in the component, but probably just an irrelevant extra milliseconds, right? – Isidro Baquero Nov 26 '14 at 9:01
  • well comparatively you can say that...still this millisecond performance hit does not create much impact on the component's overall performance and after all these triggers are meant to be used :) and whats the point of adding additional code in the component itself and create confusion – Nick Nov 26 '14 at 9:46

Here's the code you need to get started with showing you how to see what groups a user is in.

$user = JFactory::getUser();
$groups = $user->groups;
if($user->id) {
    echo $user->username.' is logged in<Br/>';
    if (isset($groups[8])) echo " - User is a Super User <Br/>";
    if (isset($groups[7])) echo " - User is an Administrator <Br/>";
    if (isset($groups[6])) echo " - User is an Manager <Br/>";
    echo 'Not logged in<Br/>';
  • Thanks GDP. This part more or less was under control. So I understand the "right way" to do it is using that on every view? – Isidro Baquero Nov 25 '14 at 15:09
  • You'd have to, unless you want to restrict all views, in which case you'd set up some component parameters, or a helper function that is used for every fiew. – GDP Nov 25 '14 at 15:14
  • Interesting... where can I go to keep researching about restricting views via component parameters? Thanks again! – Isidro Baquero Nov 25 '14 at 15:44
  • It sounds like you probably want to learn about the Joomla ACL as well, but I can only suggest Google for research, or try a a component at component-creator.com and see how it all works. Their generated code includes setting variables like $canCreate, $canEdit and $canCheckin . Once you're REALLY familiar with ACL, you can set your own ACL rule like $canView. All just suggestions - it's programming, you can do it a thousand different ways. – GDP Nov 25 '14 at 15:48
  • LOL! Ok, ok. Understood, thanks. Too much to learn... – Isidro Baquero Nov 25 '14 at 15:50

Probably the late answer to this question. But here is what I used:

In the main controller.php file I overrided display function as follows:

public function display($cachable = false, $urlparams = array())
        $user = JFactory::getUser();
        $app  = JFactory::getApplication();

        $view = $this->input->get('view');

        if ($view == 'someview' || $view == 'anotherview')
            if ($user->get('guest') == 1)
                $uri = JUri::getInstance();
                        JRoute::_('index.php?option=com_users&view=login&return=' . base64_encode($uri->toString())), $app->enqueueMessage(JText::_('COM_YOURCOMPONENT_LOGIN_REQUIRED'), 'warning')


        parent::display($cachable, $urlparams);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.