I dont know what Im doing wrong, but my addresses not showing in Address Book. I have address tab, but only one address show. When I look at Customer profiles I see more addresses of customer, but in my account Address Book only one.
This permission enabled:
- Create customer profiles of any type
- Edit own customer profiles of any type
- View own customer profiles of any type
- Create "Fakturačné údaje" customer profiles
- Edit own "Fakturačné údaje" customer profiles
- View own "Fakturačné údaje" customer profiles
- Create "Údaje o doručení" customer profiles
- Edit own "Údaje o doručení" customer profiles
- View own "Údaje o doručení" customer profiles
All adresses only show when I enable permission View any customer profile of any type , but when Im log in as authentificated user, user/75/addressbook I can always see administrator adress book user/1/addressbook, Its not good sollution.
Find another working solution, but I need help about Its security.
Each address field is view Commerce Addressbook or Commerce Addressbook Defaults. When I disable SQL rewriting in advanced setings of views I got all adresses of log in user. When I check user/1/addressbook got permission denied. It is working solution.
But is it good solution?
Using Commerce Addressbook 7.x-2.0-rc7, Commerce 7.x-1.9, views 7.x-3.7.
The similar problem when I want to show images in my cart. My googled solution, what I chosen, was disable sql rewriting.
Thanks for your advice.
| Comment | File | Size | Author |
|---|---|---|---|
| #32 | commerce_addressbook-removed_customer_profile_relationship-2218119-32.patch | 14.62 KB | michfuer |
| #28 | Screen Shot 2015-02-26 at 22.17.11.png | 33.07 KB | glicn |
| #14 | commerce_addressbook-2218119-14.patch | 873 bytes | chaby |
| #2 | commerce_addressbook-2218119-2.patch | 2.5 KB | geek-merlin |
Comments
Comment #1
geek-merlinI can confirm this. Might be a commerce commerce core permission issue.
Comment #2
geek-merlinGOTCHA!
this was really hard to hunt:
* the other-addresses view add a left-join which must be NULL
* BUT commerce access control demands that uid=current-user if it sees this table
we might fix this by fixing commerce access control in a separate issue: #2238733: NULL queries break entity query access control
the simplest fix here is to make the view "all addresses". This is obsolete or can be reverted if the other issue is accepted and committed.
(So IF anyone wants to push this forward, please implement / review the other issue as well)
Comment #3
Bird-Kid commentedI can confirm this one as well, running version 7.x-2.0-rc7.
Logged in as authenticated user, I can add addresses and upon submitting I am receiving a "Profile updated" site message, but all I ever see is the original, default address. However, when I log-in as administrator, edit that previous user and click on "Address Book", all the addresses are listed correctly.
Comment #4
geek-merlin@bird-kid: what you describe is to be expected, as this issue is about permissions.
if you apply the patch and confirm it's a fix, this will be committed faster!
Comment #5
chowk128 commentedI am also experiencing this same problem and the patch did not seem to fix the issue.
Comment #6
lmeurs commentedAt first I came to the the same solution as in the patch, then I tried only removing the relationship with
commerce_addressbook_defaultsfrom the original view and the problem seemed solved: without the default address being displayed twice! This does not make any sense, does it? :-)@chowk128: After applying the patch you should revert the view to reload the default settings from the patched file, see
admin/structure/views/view/commerce_addressbook/revert?destination=admin/structure/views/view/commerce_addressbook.Comment #7
ndeet commentedThanks a lot. I can confirm that the patch works. And all addresses are now shown for authenticated users. Using 7.x-2.0-rc7
This patch alone on rc7 causes that the users second address gets set to default because of the problem with setting the default address on first anonymous checkout. So you need to apply the mentioned patch too: https://www.drupal.org/node/2112131
Comment #8
geek-merlinSo RTBC as of #7.
Comment #9
ultimikeI can confirm that the patch in comment 2 works for me as well.
Thanks,
-mike
Comment #10
olegnaumov commentedThe patch works!
Comment #11
dxxPerfect, thanks.
Comment #12
Arsjok commentedI have read and all the threads related to this problem, I check the permissions and they are correct and I am on the latest version of the kickstart and even installed a clean version but the problem persist, I only see as the authenticated user the default view and not the view list which is what I need to show, I need the user can select the address for shipping and billing that they want... what can I do now?
Comment #13
olegnaumov commentedArsjok, just apply the patch from the comment #2.
Comment #14
chaby commentedHi,
Sorry but this is not RTBC for me. As say, it would show all adresses, including defaults, which doesn't make sense (we have an issue about this new bug introduce by patch #2!).
And indeed, this is an access commerce entity issue which didn't check LEFT JOIN. Note that by itself, the original view is correct.
But hopefully, the commerce module provide a hook to alter the useless check for this LEFT JOIN.
So here is a patch which would display all adresses except defaults.
You should revert your view to the original and apply this patch instead.
I didn't really like the way to match the context because it is not really true (ugly check on table alias generated by views). And having the query in context to check if we have a LEFT JOIN on this table would be better but it works.
In other context (which ones?), I don't think that there is a security issue with this patch or break some stuff as it rely on LEFT JOIN with IS NULL.
Comment #15
favrik commentedPatch on #14 works for me. Thanks a lot!
Comment #16
blackxylene commentedPatch on #14 works for me as well. Thanks!
Comment #17
olegnaumov commentedIndeed, #14 works!
Comment #18
jamescook commentedI have the same problem (I think) using 7.x-2.0-rc8.
Under
/user/<notadmin>/addressbookI see only one default billing and one default shipping address.
I only see all the addresses for the current authenticated user if I enable
View any customer profile of any type
I don't then see addresses e.g. of Admin (node 1) or any other users in the current user
addressbook. But I can navigate to
/user/1/addressbookand see the admin addressbook as this user.
Applying #14 with View any customer profile of any type SEEMS to make no difference. (e.g.
/user/1/addressbookshows the admin addressbook). Applying #14 without View any customer profile of any type - only the 2 default addresses are shown.What combination of patches and permissions do I need to get this right?
Comment #19
mbatterton commentedPatch #14 works for me. Many thanks.
Comment #20
geek-merlinI also found time to go to the root: Please test patch in #2238733: NULL queries break entity query access control.
Comment #21
Channel Islander commentedPatch in #14 does not work for me.
Thanks
Comment #22
Channel Islander commentedPatch in #2 does not work for me.
Patch mentioned at https://www.drupal.org/node/2112131 is already in the code in version 7.x-2.0-rc8
Comment #23
Anonymous (not verified) commentedTo get this working with 7.x-2.0-rc8 simply apply both the patch in #2 *AND* the patch in #14.
@Channel Islander: it appears that some of the other issues that you have identified are indeed "by design"... best to create new issues for those if they do not exist in the issue queue yet. It gets very difficult to manage issues when multiple are filed under one issue.
Comment #24
Channel Islander commented@Ryan Weal: Thanks for the advice, but you are mistaken. I was reporting all the apparent symptoms of this module mismanaging the addresses. Three patches are referenced here and there are multiple symptoms of what is or might be wrong. It's not going to be pretty. I understand and respect the guidelines for posting issue reports.
Comment #25
joelpittetOh I think I spotted that too!
Very likely related to this issue:
#2419499: Element validate is not saving the order's customer profile field after setting it
Comment #26
Anonymous (not verified) commented@Channel Islander: sorry that you think I'm wrong, but I got it working on my install and just wanted to report how I got it done so we can start to move this forward again. The advice about referring to the issue queue if there are potentially other issues is the same advice that is given by all mentors at DrupalCon. Apologies if that was a bit curt the way I said it, but I see Joel found a related issue so I think my point still stands. Anyway, I hope you get it working. If you manage to get it working please let us know what else you needed to do so it will help the next person dealing with this issue.
Comment #27
robit8deb commentedPatches worked for me. I was only getting the full Address book view to show on administrator account and only the default address was showing on authenticated.
Comment #28
glicn commentedHi,
Thanks for the patches. They work, but also bring a bug for me. It works fine when I input address in Germany. But when I input address in China, for example, the state/province field shows a 2-digital number rather than the state name. I took a screen shot, the number "11" should be shown as "Beijing".
Comment #29
joelpittetI'm quite sure that is unrelated @glicn, and sounds like maybe a bug for addressfield module because that is where that field is coming from. Maybe report a new bug with them https://www.drupal.org/project/issues/addressfield?categories=1
Comment #30
Gleach commentedFollowing
Having (still) the same issue as #1
Comment #31
joe_f commentedPatch #14 works for me. Thanks.
Comment #32
michfuer commentedSo I was experiencing the same problem as the OP. As a site administrator I can see the list View of customer profiles provided by commerce_addressbook, but as an authenticated user I was only seeing the default profile View.
On my end it doesn't appear to be a permissions issue. Dumping out the raw SQL for both types of users I noticed that 1) there's a redundant LEFT JOIN with the commerce_customer_profile table that's being added via the Profile ID relationship in the View, and 2) The authenticated user gets a wonky little AND condition added into the query that our site admin doesn't.
I'm not sure where the AND condition is coming from, but I can't come up with a reason the "Addressbook: Profile ID" relationship is needed, and suffice it to say that removing it resolved my issue.
This patch removes that relationship from the two default Views provided.
Comment #33
lanceh1412 commented#32 works for me.
Comment #34
wjackson commentedThe patch in #32 worked for me as well. Marking as RTBC.
Comment #35
mglaman#32 for the money shot! Extra relationship caused issue, patch fixed. Cross linked to #2541004: Add testing! to get a test added in later for this.
Comment #38
jamescook commentedFWIW - I was using rc8, now using rc9 which contains #32 - and things "got better" - users could see more than one address but the set as default behaviour was making no sense.
I needed https://www.drupal.org/node/2570353 (View commerce_addressbook_defaults doesn't return default address correctly) as well.