AC-14978 - Acl enhancement

Author: Deepak Tiwari

app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php

@@ -30,6 +30,10 @@ abstract class Create extends \Magento\Backend\App\Action
      * Controller name for edit actions
      */
     private const CONTROLLER_NAME_ORDER_EDIT = 'order_edit';
+    /**
+     * Controller name for loadblock actions
+     */
+    private const CONTROLLER_NAME_LOADBLOCK = 'loadblock';
     /**
      * @var \Magento\Framework\Escaper
      */
@@ -382,13 +386,8 @@ protected function _isAllowed()
      */
     protected function _getAclResource()
     {
-        $action = strtolower($this->getRequest()->getActionName() ?? '');
-        if (in_array($action, ['index', 'save', 'cancel']) && $this->_getSession()->getReordered()) {
-            $action = 'reorder';
-        }
-        if (strtolower($this->getRequest()->getControllerName() ?? '') === self::CONTROLLER_NAME_ORDER_EDIT) {
-            $action = 'actions_edit';
-        }
+        $action = $this->getAclResourceAction();
+
         switch ($action) {
             case 'index':
             case 'save':
@@ -403,10 +402,34 @@ protected function _getAclResource()
             case 'actions_edit':
                 $aclResource = 'Magento_Sales::actions_edit';
                 break;
+            case 'actions_sidebar':
+                $aclResource = 'Magento_Customer::customer';
+                break;
             default:
                 $aclResource = 'Magento_Sales::actions';
                 break;
         }
         return $aclResource;
     }
+
+    /**
+     * Get acl resource action
+     *
+     * @return string
+     */
+    private function getAclResourceAction(): string
+    {
+        $action = strtolower($this->getRequest()->getActionName() ?? '');
+
+        if (in_array($action, ['index', 'save', 'cancel']) && $this->_getSession()->getReordered()) {
+            $action = 'reorder';
+        }
+        if (strtolower($this->getRequest()->getControllerName() ?? '') === self::CONTROLLER_NAME_ORDER_EDIT) {
+            $action = 'actions_edit';
+        }
+        if ($action == self::CONTROLLER_NAME_LOADBLOCK && $this->getRequest()->getPost('sidebar')) {
+            $action = 'actions_sidebar';
+        }
+        return $action;
+    }
 }