Adminhtml uses the same theming fallback as the frontend, therefore you need only declare a custom template theme for your installation in module config XML:
<stores>
<admin>
<design>
<theme>
<template>custom</template>
</theme>
</design>
</admin>
</stores>
Then you can create app/design/adminhtml/default/custom/template/widget/grid.phtml with any customizations you like, and this file will be used in preference to the one from the default/default adminhtml theme. Your solution then would be to add an ACL check in the logic which renders the export control:
<?php if($this->getExportTypes() && {ACL LOGIC}}): ?>
<td class="export a-right">
<img src="<?php echo $this->getSkinUrl('images/icon_export.gif') ?>" alt="" class="v-middle"/> <?php echo $this->__('Export to:') ?>
<select name="<?php echo $this->getId() ?>_export" id="<?php echo $this->getId() ?>_export" style="width:8em;">
<?php foreach ($this->getExportTypes() as $_type): ?>
<option value="<?php echo $_type->getUrl() ?>"><?php echo $_type->getLabel() ?></option>
<?php endforeach; ?>
</select>
<?php echo $this->getExportButtonHtml() ?>
</td>
<?php endif; ?>
While this logic might be more appropriately implemented in the block class, the class rewrite system does not accommodate rewriting of parent classes, leaving you to rewrite every subclass. In this instance, obeying DRY outweighs embedding too much logic in templates. Moreover, the change is obvious and easily maintained.
Ideally the core team would have implemented this check in the Mage_Adminhtml_Block_Widget_Grid
class or at least provided a public setter for the _exportTypes
property, which would have made this logic a bit cleaner to implement.
controller_action_predispatch_adminhtml_sales_order_export_excel
andcontroller_action_predispatch_adminhtml_sales_order_export_csv
which prevents these actions if the admin_user_group is the wrong – Jost