<p>Controller actions are actually available both from the Control Panel and the front-end site. For example, <a href="http://buildwithcraft.com/classreference/controllers/EntriesController#actionSaveEntry-detail" rel="nofollow">EntriesController::actionSaveEntry()</a> could be accessed from either of these locations:</p>

<ul>
<li><a href="http://example.com/admin/actions/entries/saveEntry" rel="nofollow">http://example.com/admin/actions/entries/saveEntry</a></li>
<li><a href="http://example.com/actions/entries/saveEntry" rel="nofollow">http://example.com/actions/entries/saveEntry</a></li>
</ul>

<p>Only the first one will be considered a Control Panel URL, so it’s the only one that will enforce the “Access the CP” permission.</p>

<p>So in your case, if you’re calling a controller from a front-end page, you should just use the front-end version of the controller URL.</p>

<p>You don’t actually have to think about this stuff if you just use <a href="http://buildwithcraft.com/classreference/helpers/UrlHelper#getActionUrl-detail" rel="nofollow">UrlHelper::getActionUrl()</a>:</p>

<pre class="lang-php prettyprint-override"><code>$url = UrlHelper::getActionUrl('entries/saveEntry');
</code></pre>

<p>There’s also a corresponding <code>actionUrl()</code> function for templates:</p>

<pre class="lang-twig prettyprint-override"><code>{{ actionUrl('entries/saveEntry') }}
</code></pre>

CC BY-SA 3.0
2014-11-01T20:07:28.047Z
2014-11-01T20:07:28.047Z
Brandon Kelly
<p>If you don't want to give the user specific access to your plugin, I think the only solution is to <a href="http://buildwithcraft.com/docs/plugins/controllers#allowing-anonymous-access-to-actions" rel="nofollow">allow anonymous access to the controller action</a>. But of course, this would make the controller accessible to alll anonymous users, also outside the control panel. </p>

CC BY-SA 3.0
2014-10-31T17:16:04.583Z
Even if you allow anonymous access, you can still have custom permission logic in your controller action to decide who to let through.
Brad Bell
CC BY-SA 3.0
2014-10-31T10:23:06.447Z
2014-10-31T10:23:06.447Z
André Elvan
<p>Due to a permission check in \Craft\WebApp::processRequest(), I cannot access my plugin controller through the control panel templates. Also I cannot grant the user access because the plugin does not have a "cp section".</p>

<p>I have a fieldtype that loads data through an ajax-request, but this does not work if the user looking at the pages does not have access to the plugin.</p>

<p>Simple solution would be to always show all plugins (with controllers) in the permission overview, so that I can grant access if needed.</p>

<plugins><authentication>
Cannot access plugin controllers when plugin does not have a "cp section"
# Cannot access plugin controllers when plugin does not have a "cp section"

(Asked by: username_0 on 2014-10-31)

Due to a permission check in \Craft\WebApp::processRequest(), I cannot access my plugin controller through the control panel templates. Also I cannot grant the user access because the plugin does not have a "cp section".

I have a fieldtype that loads data through an ajax-request, but this does not work if the user looking at the pages does not have access to the plugin.

Simple solution would be to always show all plugins (with controllers) in the permission overview, so that I can grant access if needed.

**Tags:** plugins, authentication

---

## 2 answers

### Answer by username_1 on 2014-11-01. Score: 1

Controller actions are actually available both from the Control Panel and the front-end site. For example, EntriesController::actionSaveEntry() could be accessed from either of these locations:

http://example.com/admin/actions/entries/saveEntry
http://example.com/actions/entries/saveEntry

Only the first one will be considered a Control Panel URL, so it’s the only one that will enforce the “Access the CP” permission.
So in your case, if you’re calling a controller from a front-end page, you should just use the front-end version of the controller URL.
You don’t actually have to think about this stuff if you just use UrlHelper::getActionUrl():
$url = UrlHelper::getActionUrl('entries/saveEntry');

There’s also a corresponding actionUrl() function for templates:
{{ actionUrl('entries/saveEntry') }}


---

### Answer by username_2 on 2014-10-31. Score: 1

If you don't want to give the user specific access to your plugin, I think the only solution is to [allow anonymous access to the controller action](http://buildwithcraft.com/docs/plugins/controllers#allowing-anonymous-access-to-actions). But of course, this would make the controller accessible to alll anonymous users, also outside the control panel.

> **Comments:**
> **username_3**: Even if you allow anonymous access, you can still have custom permission logic in your controller action to decide who to let through.  

---

