Once all features are into place we should implement some of the access checks left at the TODO's in the code.

CommentFileSizeAuthor
#4 2505843-implemented_access_checks-4.patch2.86 KBneograph734

Comments

chadsten’s picture

chadsten commented

Worth noting - currently, users can view other users' orders at the /user/uid/orders/orderid (only of wishlist status) if they have 'view others' wishlists' permission. I added a filter of status != wishlist in the standard line item view, but it still shows an order total from somewhere.

This may be fixed with user access/expected behavior, but I wanted to leave a record of it for us.

neograph734’s picture

neograph734
he/him
Location Netherlands
commented
Status: Postponed » Active

We could start implementing this, keeping the suggestion of #1 in mind.

neograph734’s picture

neograph734
he/him
Location Netherlands
commented

Access checks for the block submodule were committed yesterday.

neograph734’s picture

neograph734
he/him
Location Netherlands
commented
Status: Active » Needs review
StatusFileSize
new 2505843-implemented_access_checks-4.patch2.86 KB

I believe this should cover it all...

neograph734’s picture

neograph734
he/him
Location Netherlands
commented

Still need to have a look at #1 btw.

  • Neograph734 committed 4ceaffe on 7.x-3.x 
    Issue #2505843: Implement access checks
Issue #2598146: Change paths...
neograph734’s picture

neograph734
he/him
Location Netherlands
commented

Got this committed. Still needs some checking.

neograph734’s picture

neograph734
he/him
Location Netherlands
commented
Status: Needs review » Fixed

#1 can no longer be reproduced, so I am closing this. Latest access issues will be handled in #2570953: Extending User Access.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.