diff --git a/app/code/Magento/Ui/Controller/Adminhtml/Index/Render.php b/app/code/Magento/Ui/Controller/Adminhtml/Index/Render.php index a0c687bde1b47..d2ce1a58725a8 100644 --- a/app/code/Magento/Ui/Controller/Adminhtml/Index/Render.php +++ b/app/code/Magento/Ui/Controller/Adminhtml/Index/Render.php @@ -127,7 +127,10 @@ private function validateAclResource($dataProviderConfigData) { if (isset($dataProviderConfigData['aclResource'])) { if (!$this->_authorization->isAllowed($dataProviderConfigData['aclResource'])) { - $this->_redirect('admin/denied'); + if (!$this->_request->isAjax()) { + $this->_redirect('admin/denied'); + } + return false; } } diff --git a/app/code/Magento/Ui/Test/Unit/Controller/Adminhtml/Index/RenderTest.php b/app/code/Magento/Ui/Test/Unit/Controller/Adminhtml/Index/RenderTest.php index 7d5de26be6d2e..9e66d6a05f17b 100644 --- a/app/code/Magento/Ui/Test/Unit/Controller/Adminhtml/Index/RenderTest.php +++ b/app/code/Magento/Ui/Test/Unit/Controller/Adminhtml/Index/RenderTest.php @@ -279,6 +279,13 @@ public function testExecuteAjaxRequestWithoutPermissions(array $dataProviderConf $this->requestMock->expects($this->any()) ->method('getParams') ->willReturn([]); + if ($isAllowed === false) { + $this->requestMock->expects($this->once()) + ->method('isAjax') + ->willReturn(true); + } + $this->responseMock->expects($this->never()) + ->method('setRedirect'); $this->responseMock->expects($this->any()) ->method('appendBody') ->with($renderedData);