Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Postponed on #3023527: Add: "View any unpublished [entity_type]" permission
Describe your bug or feature request.
The module doesn't provide a "view any unpublished commerce_product" permission.
There's only a "view own unpublished commerce_product" permission.
Therefore, commerce products created by a different user that the one who's accessing the commerce products dashboard are not showing up in the list.
Purposed resolution
We should have a "view any unpublished commerce_product" permission (or per bundle "view any unpublished %commerce_product_type commerce_product") and users with that permission should be able to see any unpublished product in the commerce product overview.
| Comment | File | Size | Author |
|---|---|---|---|
| #22 | 3262938_22.patch | 11.07 KB | mkalkbrenner |
| #17 | 3262938_simplified_check_parent.patch | 11.07 KB | mkalkbrenner |
Issue fork commerce-3262938
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
macsim commentedComment #4
macsim commentedI don't quite understand the way the permissions are managed in this module so I can't actually do more than just providing the test that has to be ok in the end.
Comment #6
macsim commentedClosing the issue. I just needed to give the "administer commerce products" permission to the role.
Comment #7
apolitsin commentedA global permission "administer commerce products" gives too much power: a user has the ability to delete any product - it's bad for linked orders.
Comment #10
plopescHello!
We had this same issue and here is a patch to solve this situation, adding those required permissions and integrating them into the whole Commerce ecosystem.
Thank you!
Comment #11
arantxioTested this in our environment and helps us a bunch. Still works for commerce 2.35. Thank you!
Comment #12
jsacksick commentedWould have been nice to have this handled by the Entity module. Unfortunately, #3023527: Add: "View any unpublished [entity_type]" permission never landed.
Comment #14
mglamanThe code needs work to make it more readable and reduce cognitive load. Also, the logic is redundant. Why add an
ORcondition for a boolean field when allowing both states?Comment #15
mkalkbrennerProductQueryAccessHandler within the current MR contains lot of code copied from its base class. I think we should avoid that redundancy and simplify the patch.
I don't want to change the existing MR, so I created a patch.
Comment #16
mkalkbrennerComment #17
mkalkbrennerEven if all tests pass, the commerce_products view breaks using the patch in #16. It just displays unpublished products.
I think I fixed that now.
In general in would be better to solve #3023527: Add: "View any unpublished [entity_type]" permission, but we need this feature quickly, so we use this patch here.
Comment #18
anybodyWe just ran into the same issue, this permission is definitely still missing. Anyway I agree with #17 - thanks for the patch @mkalkbrenner!!
So I'll set this RTBC for the maintainer to decide if this should be postponed or integrated already.
Comment #19
jsacksick commentedSince we're depending on the entity module, I also think it makes more sense to add support for the "view any unpublished [entity_type] permission" there to avoid duplicating the logic in Commerce.
Comment #20
anybodyThanks! Postponed on #3023527: Add: "View any unpublished [entity_type]" permission
Comment #21
jsacksick commentedEven if the Entity API fix lands, we'll still need to update Commerce, so we need to keep this opened :). But I guess "postponed" is an okay status.
I personally don't have commit access to the Entity API module so I cannot be the one merging the MR there unfortunately.
Comment #22
mkalkbrennerHere's a patch against commerce 3.3.2