Closed (fixed)
Project:
Commerce Core
Version:
7.x-1.x-dev
Component:
Line item
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
21 Aug 2012 at 13:02 UTC
Updated:
10 Oct 2012 at 03:41 UTC
If the current user has no permission 'administer line items' AND commerce_order modul not exist in commerce_line_item_access() function has no return value!
ps: use Phpstorm, this write to me well :)
Current code:
function commerce_line_item_access($op, $line_item, $account = NULL) {
global $user;
$account = isset($account) ? $account : clone($user);
// If the user has the administration permission, return TRUE now.
if (user_access('administer line items', $account)) {
return TRUE;
}
// For users who don't have the general administration permission, we have to
// determine access to update or delete a given line item through a connection
// to an Order.
if (!empty($line_item->order_id) && module_exists('commerce_order')) {
$order = commerce_order_load($line_item->order_id);
return commerce_order_access($op, $order, $account);
}
}
Comments
Comment #1
rszrama commentedI suppose this should just be returning FALSE?
Comment #2
rszrama commentedWent ahead and updated this to return FALSE if we pass through that order if statement.
Commit: http://drupalcode.org/project/commerce.git/commitdiff/f3dfdac