I dont know what Im doing wrong, but my addresses not showing in Address Book. I have address tab, but only one address show. When I look at Customer profiles I see more addresses of customer, but in my account Address Book only one.
This permission enabled:

  • Create customer profiles of any type
  • Edit own customer profiles of any type
  • View own customer profiles of any type
  • Create "Fakturačné údaje" customer profiles
  • Edit own "Fakturačné údaje" customer profiles
  • View own "Fakturačné údaje" customer profiles
  • Create "Údaje o doručení" customer profiles
  • Edit own "Údaje o doručení" customer profiles
  • View own "Údaje o doručení" customer profiles

All adresses only show when I enable permission View any customer profile of any type , but when Im log in as authentificated user, user/75/addressbook I can always see administrator adress book user/1/addressbook, Its not good sollution.
Find another working solution, but I need help about Its security.
Each address field is view Commerce Addressbook or Commerce Addressbook Defaults. When I disable SQL rewriting in advanced setings of views I got all adresses of log in user. When I check user/1/addressbook got permission denied. It is working solution.
But is it good solution?

Using Commerce Addressbook 7.x-2.0-rc7, Commerce 7.x-1.9, views 7.x-3.7.

The similar problem when I want to show images in my cart. My googled solution, what I chosen, was disable sql rewriting.

Thanks for your advice.

Comments

geek-merlin’s picture

I can confirm this. Might be a commerce commerce core permission issue.

geek-merlin’s picture

Status: Active » Needs review
Related issues: +#2238733: NULL queries break entity query access control
StatusFileSize
new2.5 KB

GOTCHA!
this was really hard to hunt:
* the other-addresses view add a left-join which must be NULL
* BUT commerce access control demands that uid=current-user if it sees this table

we might fix this by fixing commerce access control in a separate issue: #2238733: NULL queries break entity query access control

the simplest fix here is to make the view "all addresses". This is obsolete or can be reverted if the other issue is accepted and committed.

(So IF anyone wants to push this forward, please implement / review the other issue as well)

Bird-Kid’s picture

I can confirm this one as well, running version 7.x-2.0-rc7.

Logged in as authenticated user, I can add addresses and upon submitting I am receiving a "Profile updated" site message, but all I ever see is the original, default address. However, when I log-in as administrator, edit that previous user and click on "Address Book", all the addresses are listed correctly.

geek-merlin’s picture

@bird-kid: what you describe is to be expected, as this issue is about permissions.

if you apply the patch and confirm it's a fix, this will be committed faster!

chowk128’s picture

I am also experiencing this same problem and the patch did not seem to fix the issue.

lmeurs’s picture

Category: Support request » Bug report

At first I came to the the same solution as in the patch, then I tried only removing the relationship with commerce_addressbook_defaults from the original view and the problem seemed solved: without the default address being displayed twice! This does not make any sense, does it? :-)

@chowk128: After applying the patch you should revert the view to reload the default settings from the patched file, see admin/structure/views/view/commerce_addressbook/revert?destination=admin/structure/views/view/commerce_addressbook.

ndeet’s picture

Thanks a lot. I can confirm that the patch works. And all addresses are now shown for authenticated users. Using 7.x-2.0-rc7

This patch alone on rc7 causes that the users second address gets set to default because of the problem with setting the default address on first anonymous checkout. So you need to apply the mentioned patch too: https://www.drupal.org/node/2112131

geek-merlin’s picture

Status: Needs review » Reviewed & tested by the community

So RTBC as of #7.

ultimike’s picture

I can confirm that the patch in comment 2 works for me as well.

Thanks,
-mike

olegnaumov’s picture

The patch works!

dxx’s picture

Perfect, thanks.

Arsjok’s picture

I have read and all the threads related to this problem, I check the permissions and they are correct and I am on the latest version of the kickstart and even installed a clean version but the problem persist, I only see as the authenticated user the default view and not the view list which is what I need to show, I need the user can select the address for shipping and billing that they want... what can I do now?

olegnaumov’s picture

Arsjok, just apply the patch from the comment #2.

chaby’s picture

Status: Reviewed & tested by the community » Needs review
StatusFileSize
new873 bytes

Hi,

Sorry but this is not RTBC for me. As say, it would show all adresses, including defaults, which doesn't make sense (we have an issue about this new bug introduce by patch #2!).
And indeed, this is an access commerce entity issue which didn't check LEFT JOIN. Note that by itself, the original view is correct.

But hopefully, the commerce module provide a hook to alter the useless check for this LEFT JOIN.

So here is a patch which would display all adresses except defaults.
You should revert your view to the original and apply this patch instead.

I didn't really like the way to match the context because it is not really true (ugly check on table alias generated by views). And having the query in context to check if we have a LEFT JOIN on this table would be better but it works.
In other context (which ones?), I don't think that there is a security issue with this patch or break some stuff as it rely on LEFT JOIN with IS NULL.

favrik’s picture

Patch on #14 works for me. Thanks a lot!

blackxylene’s picture

Patch on #14 works for me as well. Thanks!

olegnaumov’s picture

Indeed, #14 works!

jamescook’s picture

I have the same problem (I think) using 7.x-2.0-rc8.
Under /user/<notadmin>/addressbook
I see only one default billing and one default shipping address.

I only see all the addresses for the current authenticated user if I enable
View any customer profile of any type
I don't then see addresses e.g. of Admin (node 1) or any other users in the current user
addressbook. But I can navigate to
/user/1/addressbook
and see the admin addressbook as this user.

Applying #14 with View any customer profile of any type SEEMS to make no difference. (e.g. /user/1/addressbook shows the admin addressbook). Applying #14 without View any customer profile of any type - only the 2 default addresses are shown.

What combination of patches and permissions do I need to get this right?

mbatterton’s picture

Patch #14 works for me. Many thanks.

geek-merlin’s picture

I also found time to go to the root: Please test patch in #2238733: NULL queries break entity query access control.

Channel Islander’s picture

Patch in #14 does not work for me.

  • It does restore second profile, but only two.
  • I have three profiles for my test user and only two show up in address book (before patch was only one!).
  • Second profile is made default in address book. But first profile is selected in checkout.

Thanks

Channel Islander’s picture

Version: 7.x-2.0-rc7 » 7.x-2.0-rc8
Status: Needs review » Needs work

Patch in #2 does not work for me.

  • It does restore all the customer profiles in the address book
  • It does allow to set a profile as default profile
  • (However, it shows the default profile twice, once above the others [presumably as the default, but not labeled as such], and once in the list of all profiles below. Is this as designed/
  • But in checkout, the first profile is always selected

Patch mentioned at https://www.drupal.org/node/2112131 is already in the code in version 7.x-2.0-rc8

Anonymous’s picture

Status: Needs work » Needs review

To get this working with 7.x-2.0-rc8 simply apply both the patch in #2 *AND* the patch in #14.

@Channel Islander: it appears that some of the other issues that you have identified are indeed "by design"... best to create new issues for those if they do not exist in the issue queue yet. It gets very difficult to manage issues when multiple are filed under one issue.

Channel Islander’s picture

@Ryan Weal: Thanks for the advice, but you are mistaken. I was reporting all the apparent symptoms of this module mismanaging the addresses. Three patches are referenced here and there are multiple symptoms of what is or might be wrong. It's not going to be pretty. I understand and respect the guidelines for posting issue reports.

joelpittet’s picture

But in checkout, the first profile is always selected

Oh I think I spotted that too!

Very likely related to this issue:
#2419499: Element validate is not saving the order's customer profile field after setting it

Anonymous’s picture

@Channel Islander: sorry that you think I'm wrong, but I got it working on my install and just wanted to report how I got it done so we can start to move this forward again. The advice about referring to the issue queue if there are potentially other issues is the same advice that is given by all mentors at DrupalCon. Apologies if that was a bit curt the way I said it, but I see Joel found a related issue so I think my point still stands. Anyway, I hope you get it working. If you manage to get it working please let us know what else you needed to do so it will help the next person dealing with this issue.

robit8deb’s picture

Patches worked for me. I was only getting the full Address book view to show on administrator account and only the default address was showing on authenticated.

glicn’s picture

StatusFileSize
new33.07 KB

Hi,
Thanks for the patches. They work, but also bring a bug for me. It works fine when I input address in Germany. But when I input address in China, for example, the state/province field shows a 2-digital number rather than the state name. I took a screen shot, the number "11" should be shown as "Beijing".

joelpittet’s picture

I'm quite sure that is unrelated @glicn, and sounds like maybe a bug for addressfield module because that is where that field is coming from. Maybe report a new bug with them https://www.drupal.org/project/issues/addressfield?categories=1

Gleach’s picture

Following

Having (still) the same issue as #1

joe_f’s picture

Patch #14 works for me. Thanks.

michfuer’s picture

So I was experiencing the same problem as the OP. As a site administrator I can see the list View of customer profiles provided by commerce_addressbook, but as an authenticated user I was only seeing the default profile View.

On my end it doesn't appear to be a permissions issue. Dumping out the raw SQL for both types of users I noticed that 1) there's a redundant LEFT JOIN with the commerce_customer_profile table that's being added via the Profile ID relationship in the View, and 2) The authenticated user gets a wonky little AND condition added into the query that our site admin doesn't.

I'm not sure where the AND condition is coming from, but I can't come up with a reason the "Addressbook: Profile ID" relationship is needed, and suffice it to say that removing it resolved my issue.

This patch removes that relationship from the two default Views provided.

lanceh1412’s picture

#32 works for me.

wjackson’s picture

Status: Needs review » Reviewed & tested by the community

The patch in #32 worked for me as well. Marking as RTBC.

mglaman’s picture

Status: Reviewed & tested by the community » Fixed

#32 for the money shot! Extra relationship caused issue, patch fixed. Cross linked to #2541004: Add testing! to get a test added in later for this.

  • mglaman committed e6e2aea on 7.x-2.x authored by michfuer
    Issue #2218119 by axel.rutz, chaby, michfuer: Only one billing or...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

jamescook’s picture

FWIW - I was using rc8, now using rc9 which contains #32 - and things "got better" - users could see more than one address but the set as default behaviour was making no sense.

I needed https://www.drupal.org/node/2570353 (View commerce_addressbook_defaults doesn't return default address correctly) as well.