If a user has the "administer store" permission, but not the "administer product features" permission an error is raised when they visit /admin/store/settings/products. If I give the user "administer product features" the error disappears.

The error given is:
warning: call_user_func_array() [function.call-user-func-array]: First argument is expected to be a valid callback, 'a' was given in .../form.inc on line 366

I think the error is caused from the 'items' key being an empty array in uc_product_settings_overview(). Here is a dump of that key in the $summaries array:
[2]=>
array(4) {
["path"]=>
string(44) "/admin/store/settings/products/edit/features"
["href"]=>
string(43) "admin/store/settings/products/edit/features"
["title"]=>
string(16) "Product features"
["items"]=>
array(0) {
}

CommentFileSizeAuthor
#1 481088.summary_perms.2.x.patch531 bytescha0s

Comments

cha0s’s picture

cha0s commented
Assigned: Unassigned » cha0s
Status: Active » Needs review
StatusFileSize
new 481088.summary_perms.2.x.patch531 bytes

The real bug is that the summary API should skip over any children the user can't access. It's a wonder no one found that until now! Thanks for the report... =)

Island Usurper’s picture

Island Usurper commented
Status: Needs review » Fixed

So, I had decided that it was better to show the summaries but not let people click on them to get an "Access Denied" error, and I had even wrote up a patch to do that. And then I decided your way was better after all. There might indeed be some kind of sensitive information that gets displayed in a summary, so people shouldn't see it if they can't change it.

By the way, all if() blocks should use braces, even if they're only around one line. Committed with that change. :)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.