For the "manage credit cards" page (user/%user/creditcards), there is a custom access callback uc_cim_manage_cards_access().

This access callback provides access to users managing their own credit cards. This part is correct.
It ALSO provides access to users with the 'administer credit cards' permission.

This is incorrect. Instead, it should check for the 'process credit cards' permission, so that users with that level of access can manage users' credit cards through their user account page.

The 'process credit card' permission is correctly used 5 other times throughout the module - this is the only place the permission is not correctly declared.

The only way for store admins to manage a user's credit cards is through the store orders interface, which is not ideal when trying to modify the data for a particular user.

Comments

j.helmer’s picture

j.helmer commented

Any progress? This is a high-volume production site, and I don't want to have to do a hook_menu_alter to fix this.

j.helmer’s picture

j.helmer commented

OK I have no choice but to write a hook_menu_alter() that will accomplish the fix.

In case anyone wants to turn this into a patch, the current access code is:

/**
 * Access callback for credit card management.
 */
function uc_cim_manage_cards_access($account) {
  return (($GLOBALS['user']->uid == $account->uid) || user_access('administer credit cards')) && $account->uid > 0;
}

And instead should be:

/**
 * Access callback for credit card management.
 */
function uc_cim_manage_cards_access($account) {
  return (($GLOBALS['user']->uid == $account->uid) || user_access('process credit cards')) && $account->uid > 0;
}
m.stenta’s picture

m.stenta
he/him
Primary language English
commented
Status: Active » Closed (fixed)

Thanks j.helmer!

Comitted!