Right now the only access control you have if you want to allow people to view coupons, is administer coupons.

This is pretty bad since access is required when viewing fx your own coupon on the order via the entity reference field. We should have proper CRUD permissions.

CommentFileSizeAuthor
#4 1856822_remove_debug.patch522 bytesgoogletorp
#2 1856822-2-proper_access_control.patch2.66 KBgoogletorp
#1 1856822-proper_access_control.patch2.63 KBgoogletorp

Comments

googletorp’s picture

googletorp commented
Status: Active » Needs review
StatusFileSize
new 1856822-proper_access_control.patch2.63 KB

And the patch.

googletorp’s picture

googletorp commented
StatusFileSize
new 1856822-2-proper_access_control.patch2.66 KB

Fixed typo in previous patch.

pcambra’s picture

pcambra
he/him
Primary language Spanish
commented
Status: Needs review » Fixed

Nice idea, I've implemented a different and more complete version by relying on commerce_entity_access tools.

http://drupalcode.org/project/commerce_coupon.git/commit/1d57ae4c6c71ec9...

Thanks

googletorp’s picture

googletorp commented
Status: Fixed » Needs review
StatusFileSize
new 1856822_remove_debug.patch522 bytes

Looks good, but you had debug code in your commit.

Added a patch that fixes this.

pcambra’s picture

pcambra
he/him
Primary language Spanish
commented
Status: Needs review » Fixed

Thanks for the catch, fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.