Product attribute translation doesn't work unless permission "Translate configuration" is given to the user role

Created on 3 May 2022, over 2 years ago
Updated 23 May 2024, 6 months ago

Describe your bug or feature request.

/admin/commerce/product-attributes/manage/{attribute}/translate gives 403 Access denied pages to content editors unless we give them "translate configuration" permission. Giving that permission to them is not a good solution because that way we also enable access to other translating-related core administration form pages such as /admin/config/regional/config-translation and /admin/config/regional/translate.

If a bug, provide steps to reproduce it from a clean install.

1. install commerce, so that you can create products and product attributes
2. enable the 4 Drupal Drupal core translation-related modules
3. add another language to Drupal
4. enable translations for product attributes, products, product variations
5. create a content administrator user role that
6. try to set permissions so that with this role users could be able to manage products, variations, orders and product attributes
7. create a user with that role
8. login with this user
9. try to add product attributes and translations to the product attributes.
10. instead of the attributes' translation form, you should see Access denied

🐛 Bug report
Status

Fixed

Version

3.0

Component

User experience

Created by

🇸🇰Slovakia kaszarobert

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇨🇭Switzerland Lukas von Blarer

    I have the same issue. @kaszarobert did you come up with a solution for this?

  • 🇸🇰Slovakia kaszarobert

    Not really. Frankly, we didn't mess around with that and we simply gave that permission to the shop owners and told them, that they should edit only product, order, content, taxonomy forms and leave the rest of the settings pages alone, and they did that.

  • First commit to issue fork.
  • Pipeline finished with Failed
    7 months ago
    Total: 354s
    #154521
  • Pipeline finished with Failed
    7 months ago
    Total: 627s
    #154544
  • Pipeline finished with Success
    7 months ago
    Total: 442s
    #154585
  • 🇺🇦Ukraine tbkot

    Patch with changes from MR. To add access for users to translate product attributes add the "Translate product attribute" permission

  • Status changed to Needs review 7 months ago
  • Status changed to Needs work 7 months ago
  • 🇮🇱Israel jsacksick
    1. +++ b/modules/product/commerce_product.module
      @@ -377,3 +377,27 @@ function commerce_product_field_group_content_element_keys_alter(&$keys) {
      +function commerce_product_entity_operation_alter(array &$operations, EntityInterface $entity): void {
      

      Do we really need this? Isn't the access automatically checked for the route?

    2. +++ b/modules/product/commerce_product.module
      @@ -377,3 +377,27 @@ function commerce_product_field_group_content_element_keys_alter(&$keys) {
      +  // operation is not exist we need to check if the user has access to manage
      

      is not exist -> does not exist.

    3. +++ b/modules/product/commerce_product.permissions.yml
      @@ -2,3 +2,8 @@
      +'translate product attribute':
      

      perhaps we should make this:
      translate "commerce_product_attribute"
      to match "administer commerce_product_attribute".

      I don't really see places where we just drop the prefix.

    4. +++ b/modules/product/src/ConfigTranslation/ProductAttributeMapper.php
      @@ -24,7 +26,42 @@ class ProductAttributeMapper extends ConfigEntityMapper {
      +  private function addTranslationFormAccessCheck(Route &$route): void {
      

      In general, we prefer protected methods to allow for overrides in commerce core / contrib... I know it's tempting to add private methods, but... that isn't what we usually do :).

  • Pipeline finished with Failed
    7 months ago
    Total: 473s
    #156714
  • Status changed to Needs review 7 months ago
  • 🇺🇦Ukraine tbkot

    @jsacksick

    1. We need to check access to the URL before adding it to the operation list, in another case users without access to this page would see the link but the page will return an access denied exception
    2. Fixed
    3. Permission renamed to "translate commerce_product_attribute"
    4. Fixed

  • Status changed to Fixed 7 months ago
  • 🇮🇱Israel jsacksick

    Committed, thanks!

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024