I'm using Commerce Card on File 7.x-2.0-beta2 and Commerce Authnet 7.x-1.1+5-dev. I have 5 cards stored on file that are visible in the admin panel admin/commerce/cards but for each user with a card on file, with the exception of the admin account their Stored Cards page, user/*/cards page only says "You do not have any stored credit cards on file for this account."

I checked all of the permission settings and granted permissions for all users, including Anonymous to:

  • View own card data
  • Create own card data
  • Edit own card data
  • Delete own card data

Comments

dgwebcreative’s picture

Component: User interface » Miscellaneous
Issue summary: View changes
caspervoogt’s picture

+1. Seeing this here too. I even tried it with Authenticated users having all Card on File permissions (not safe, I know!!), to no avail. So it seems it may not be a purely permissions thing.

caspervoogt’s picture

I just tried editing the "commerce_card_on_file_user_cards" "page" display and tried setting permissions and contextual filters, to no avail. It actually previews in Views (when I put in the user id as an argument) but won't render on the actual page.

oystercrackher’s picture

I am having the same issue.

ddavis1138’s picture

I did some testing on the permissions and found that the "View any customer profile of any type" allows a user to view the card data. Obviously this is a security risk. For some reason the "View own customer profiles of any type" is not working to control permission for individual users. I would guess the verification to view the card data is not utilizing the correct "Customer Profile" permission.

bojanz’s picture

Status: Active » Fixed

The view has a relationship to customer profiles, which makes it subject to its query access.
I have committed a re-exported view without the billing information because I believe it's not essential enough to be shown there (it's more for the edit page).
If you decide to readd it, you should go to Query settings and disable Query rewriting. That will turn off the query access.

ddavis1138’s picture

I am still getting the error. I tried removing the relationship with the Customer Profile: Billing Address but then I see every stored card from every user. So I either get no cards or all cards. How can I only get the cards for the current user to display?

oystercrackher’s picture

@ddavis1138

You can try editing the view "Stored Credit Cards: User (Commerce Card On File) View and use a contextual filter with UID or add "current logged in user" under filters. One of those should do the trick. Additionally, make sure that the permissions for the page have "View Own Card Data".

Thanks

bojanz’s picture

You need to revert the view in order to get the latest one from beta3 / beta4.

ddavis1138’s picture

That did it... Thank you.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.