Contrib.social

Order: reassign without administrative privileges results in access denied

Open on Drupal.org →
Created on 11 August 2020, over 4 years ago
Updated 2 September 2024, 7 months ago

Problem/Motivation

When a user does not have the "Administer orders" privilige but has for example the "Default: update order" permission, the person will see on the order overview page for each Default order type an operation "Reassign". When loading the OrderReassignForm the person will get an access denied page.

This is because in the commerce_order.routing.yml file the required permission to reach this route is "administer commerce_order" in stead of an access check, like seen in the OrderListBuilder.php on line 111.

Steps to reproduce

On Drupal 8.9:
1. Install commerce version 2.20
2. Use the default commerce_order
3. Create a role that has the "Administer orders" permission (and add permission to view the order overview page)
4. Create a role that has the "Default: update order" permission (and add permission to view the order overview page)
5. Create a default product that uses the default order
6. Create a default order
7. Login as the user with the role that has the "Default: update order" permission
8. You will see that the operations include "Reassign"
9. When clicking the "Reassign" link, you will get an access denied.

Proposed resolution

Change the commerce_order.routing.yml 'entity.commerce_order.reassign_form' permission requirement to an entity access 'commerce_order.update' so it's an equal permissions check to the link generation on the order operations.

Remaining tasks

Review.

User interface changes

None.

API changes

None.

Data model changes

None.

🐛 Bug report
Status

Fixed

Version

2.0

Component

Order

Created by

🇧🇪Belgium ReBa

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024