- 🇬🇧United Kingdom alexpott 🇪🇺🌍
This is definitely an issue. The views in the module are shipping with a permission that does not exist. I think that having permissions for for price rules, price lists and price list items is unnecessary. Atm:
- price rule uses Drupal\commerce\EntityPermissionProvider
- price list uses Drupal\commerce\EntityPermissionProvider
- price list item uses "administer commerce_price_rule"
Not sure of the correct structure though. It feels like price list item should use something from price list and not price rule.
- 🇨🇷Costa Rica estebanvalerio.h
The patch is doing its job and provides a solution for this "problem". It works propertly on the project we are using it and the patch code itself is well-structured, security-focused, and properly implemented. It addresses all the stated issues:
- Adds missing permissions for price list items
- Makes "Access the price rules overview page" functional
- Fixes Price List entity admin permissions
- Makes Views respect proper view permissionsThe patch follows Drupal best practices and enhances security through proper permission granularity.