Anonymous users never get access to view their previously chosen line item options. This is assuming the product is using a commerce_product_option option set.

Step to reproduce:

  1. Add a new commerce product option set
  2. Configure a product to use the option set.
  3. Log out
  4. Add the configured product line item to the cart
  5. Edit the line item by navigating to the line item's display path and pass a query string of ?line_item_id=1234 (replacing 1234 with a valid line item id)

So the expected behavior is to see the default values of the line item edit form populated with the previously entered values. This works for admin and authenticated users. However, anonymous users simply see a blank form.

So, my first hunch was to look at permissions. Commerce line item module has an 'administer line items' permission that, when granted to anonymous, produced the desired behavior. However, it also gave anonymous access to edit any line item which was undesired.

I found a bug in commerce_product_attributes_access_to_line_item(), where sometimes the line item object passed to it is in fact sometimes simply a line item ID. I can't really figure out why that is happening, but I just threw in a condition to account for that happening, and this is working.

Feedback greatly appreciated, I know this module needs some love.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kid_icarus’s picture

Issue summary: View changes

Updated issue summary.

kid_icarus’s picture

Issue summary: View changes

Updated issue summary.

mengi’s picture

If you give users access to 'View any product of any type' it will work. There is a warning, but according to the drupal commerce issue queue it is not a supposed to be there. Just make sure you use filters to remove disabled products from the view.

Anybody’s picture

Priority: Normal » Major
Status: Needs review » Reviewed & tested by the community

The patch is much better than the hint from #1 because it fixes the problem very near at the problems code. The patch works great and I can't see any danger in it.

Setting up the priority and status after several tests. This is major because else the module does not work right for anonymous users when using option sets.