EspoCRM 4.0.0 Dashboard Screen "Error 403 : Access Denied" Message

[krisk]

I'm consistently getting a momentary "Error 403: Access Denied" message when I click to access the main Dashboard screen. Once the message goes away, I can access and use the Dashboard. Otherwise, no error message when accessing other screens. The error message appears for both administrative and non-administrative users. This message occurs only with the new 4.0.0 release. I'm not seeing the error message with version 3.9.2. Both versions are installed on the same server.

I solved the error message issue for administrator logins. It was caused by a server configuration problem. However, I'm still receiving the momentary "Error 403: Access Denied" message when non-administrative users click to access the main Dashboard screen. This occurs on 4.0.0, but not on 3.9.2. I checked my apache server error log. No errors are being logged now that I addressed the server config issue. However, the following is one of many, similar error messages from the EspoCRM-4.0.0 log file in /data/logs:

[2016-03-02 21:06:14] Espo.ERROR: API [GET]:/:controller/action/:action, Params:Array ( [controller] => Opportunity [action] => reportByStage ) , InputData: - [] [
]
[2016-03-02 21:06:14] Espo.ERROR: Display Error: , Code: 403 URL: /EspoCRM-4.0.0/api/v1/Opportunity/action/reportByStage?dateFrom=2016-01-01&dateTo=20
16-12-31 [] []

[yuri]

Hi

Seems users don't have access to Opportunity but they have Opportunities by Stage dashlet on their dashboard. If they remove this dashlet the error won't show up. Can you confirm?

[yuri]

Although it could be a bug. I will look.

[krisk]

Yes, the error message goes away if I remove all of the following dashlets from the non-administrative user's Dashboard: Opportunities by Lead Source; Opportunities by Stage; Sales by Month; and Sales Pipeline. The non-administrative user is assigned to a Team that is governed by a Role I've set up, which has the following settings for Opportunities: Access-enabled; Create-yes; Read-team; Edit-team; Delete-no. I think it makes sense to restrict non-administrative user access to these dashlets and I hope you will retain this feature, but I'm not sure the program is accomplishing this in a way that clearly makes sense to non-technical users like me. Would it be possible to allow an administrator to restrict dashlet access for non-administrative users more directly? For example, as part of the User Interface settings, allow the administrator to select the dashlets that are available to non-admin users? By the way, you are doing a great job with this program!

[yuri]

Hi

It should be already fixed in 4.0.2. Thanks for report.