Permissions - Empty "Selling" header appears on non-seller user profile

jbrodbeck - July 1, 2009 - 20:54
Project:Ubercart Marketplace
Version:6.x-1.x-dev
Component:User interface
Category:task
Priority:normal
Assigned:Unassigned
Status:duplicate
Description

The "Selling" header appears on the user profile page for authenticated users who are not sellers. The category shows up with a header even for those who cannot 'view own products', 'fulfill own orders', 'view own reports', or 'act as seller'. A quick fix would be to open up mp_products.module and add a conditional on line 51:

old code:

$account->content['products'] = array(
  '#type' => 'user_profile_category',
  '#title' => t('Selling'),
  'link' => array(
    '#value' => $link,
    '#type' => 'user_profile_item',
  ),
);

new code:

if (module_exists(mp_reports) && user_access('act as seller')) {
  $account->content['products'] = array(
    '#type' => 'user_profile_category',
    '#title' => t('Selling'),
    'link' => array(
      '#value' => $link,
      '#type' => 'user_profile_item',
    ),
  );
}

It might make more sense to check access earlier in the function as I'm not sure why anyone who does not 'act as seller' would be able to perform any of those functions.

#1

jbrodbeck - July 1, 2009 - 21:09

Additionally, it might also help to check $account->uid == $user->uid or something of that sort since it seems, admin access withstanding, the user should only be able to see their own products on the user profile page (if that is not checked already).

#2

jbrodbeck - July 1, 2009 - 21:43
Priority:minor» normal

I keep replying to myself but apparently the "Selling" category does show on profiles other than the user's own. In that case, the code should probably read like this:

new code:

if (user_access('act as seller') && $user->uid == $account->uid) {
  $account->content['products'] = array(
    '#type' => 'user_profile_category',
    '#title' => t('Selling'),
    'link' => array(
      '#value' => $link,
      '#type' => 'user_profile_item',
    ),
  );
}

Removed the check for mp_reports since that wasn't correct.

#3

jbrodbeck - October 6, 2009 - 00:48
Status:active» duplicate

Duplicate but fixed.

 
 

Drupal is a registered trademark of Dries Buytaert.