Closed (fixed)
Project:
Commerce Card on File
Version:
7.x-2.0-beta2
Component:
Miscellaneous
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
23 Mar 2014 at 16:22 UTC
Updated:
28 May 2014 at 22:50 UTC
Jump to comment: Most recent
Comments
Comment #1
dgwebcreative commentedComment #2
caspervoogt commented+1. Seeing this here too. I even tried it with Authenticated users having all Card on File permissions (not safe, I know!!), to no avail. So it seems it may not be a purely permissions thing.
Comment #3
caspervoogt commentedI just tried editing the "commerce_card_on_file_user_cards" "page" display and tried setting permissions and contextual filters, to no avail. It actually previews in Views (when I put in the user id as an argument) but won't render on the actual page.
Comment #4
oystercrackher commentedI am having the same issue.
Comment #5
ddavis1138 commentedI did some testing on the permissions and found that the "View any customer profile of any type" allows a user to view the card data. Obviously this is a security risk. For some reason the "View own customer profiles of any type" is not working to control permission for individual users. I would guess the verification to view the card data is not utilizing the correct "Customer Profile" permission.
Comment #6
bojanz commentedThe view has a relationship to customer profiles, which makes it subject to its query access.
I have committed a re-exported view without the billing information because I believe it's not essential enough to be shown there (it's more for the edit page).
If you decide to readd it, you should go to Query settings and disable Query rewriting. That will turn off the query access.
Comment #7
ddavis1138 commentedI am still getting the error. I tried removing the relationship with the Customer Profile: Billing Address but then I see every stored card from every user. So I either get no cards or all cards. How can I only get the cards for the current user to display?
Comment #8
oystercrackher commented@ddavis1138
You can try editing the view "Stored Credit Cards: User (Commerce Card On File) View and use a contextual filter with UID or add "current logged in user" under filters. One of those should do the trick. Additionally, make sure that the permissions for the page have "View Own Card Data".
Thanks
Comment #9
bojanz commentedYou need to revert the view in order to get the latest one from beta3 / beta4.
Comment #10
ddavis1138 commentedThat did it... Thank you.