I’m having a problem installing new modules after manually upgrading my site to 8.9. I’m getting Access Denied errors even though I am logged in as admin (and have all permissions).

Looking at the reports, authorise.php is throwing the error. It is reporting that I am trying to execute this operation as anonymous (not verified).

I’m not understanding how this is possible and I am wondering if others have come across it. The upgrade was mostly routine and I'm still not convinced it has anything to do with the issue. But like everyone else I am prone to post hoc, ergo propter hoc conclusions.

Any help on a solution is greatly appreciated.

The following information may help someone work out the how and why :

  1. The upgrade was from 8.6 to 8.9. PHP 7.3.19 is installed.

  2. The site is in a subdirectory /dev (which has not caused problems previously and does not now)

  3. The upgrade went for the most part smoothly. I took the following steps: (i) Various backups, put site into maintenance mode. (ii) unpacked Drupal 8.9 on the server. (iii) Under /dev, deleted core and vendor folders, preserving themes, modules, sites and profiles. (iv) Deleted all other files under /dev (v) Copied in new core and vendor folders, plus the top level 8.9 files including .htaccess (which contained no change in the RewriteBase) (vi). Ran /dev/update.php

At this point an error occurred claiming I did not have the permission to “Administer Software Updates” which I do have of course course as admin. When I did this step earlier on my test server there was no issue (although it was on a different host).

  1. To to get the update to complete, I changed, as recommended,the $settings[‘update_free_access’] to TRUE in ~/public_html/dev/sites/default/settings.php , line 306.

So the update operation (running update.php) was not done under admin. Is this possibly something to do with the issue?

5.There were several errors reported at the time of the upgrade like this: Notice: Undefined index: core_incompatible in Drupal\Core\Extension\ExtensionList->checkIncompatibility() (line 580 of /home1/uamelbc1/public_html/dev/core/lib/Drupal/Core/Extension/ExtensionList.php).

I don’t think this is important but line 580 does reference the php version.

  1. The Webform module is installed, and after the upgrade, requires many updates. Possibly related to 5? I have not yet done these updates. All other installed modules are reported as updated.

  2. Apart from not being able to install new modules, as far as I can tell, I still have all other admin capabilities.

  3. Just in case it is not clear, the site is upgraded to 8.9, the redirect to /dev is working.

Here are my (scattered) thoughts on the Access Denied:

core/authorize.php contains a function:

function authorize_access_allowed(Request $request) {
  $account = \Drupal::service('authentication')->authenticate($request);
  if ($account) {
  return Settings::get('allow_authorize_operations', TRUE) && \Drupal::currentUser()->hasPermission('administer software updates');

This should return True. As I said before I have the “Administer Software Updates”. But that can't be right: Drupal thinks I'm anonymous.

In settings.php, there is the line

# $settings['allow_authorize_operations'] = FALSE; 

Commented out. So what is the default? Is it True? (not usual). Or is set somewhere else? Should I try setting it to True?

  • How are you trying to install the modules? e.g. using the web interface "/admin/modules/install". In regrade to your post, the traditional update and install is not recommended anymore. You need to learn how to use "Composer" to do this. – Hodba Khalaf Jun 22 at 12:54
  • Yes, I am installing modules through the web interface.Everyone goes on about Composer! That is not very helpful. I did a manual install. It worked fine on my test server. I manually installed 8.6 2 years ago. Everything worked fine. It is not that difficult. Everything is perfect with this upgrade too except for this one problem. – robusto Jun 22 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.