In RulesUIController::overviewTable()

   foreach ($entities as $id => $entity) {
      if (user_access('bypass rules access') || $entity->access()) {
        $rows[] = $this->overviewTableRow($conditions, $id, $entity, $options);
      }
    }

By the time this $entity->access() call meanders its way through to EntityDrupalWrapper::entityAccess(), its $entity_type has been set to "commerce_order" and $entity object itself is empty. This results in the permission "view any commerce order" controlling the display on the rules overview page, when the reaction rule is a payment method.

Changing the above code to

    foreach ($entities as $id => $entity) {
      $wrapper = entity_metadata_wrapper('rules_config', $entity);
      if (user_access('bypass rules access') || $wrapper->access('view')) {
        $rows[] = $this->overviewTableRow($conditions, $id, $entity, $options);
      }
    }

appears to put the overview page back under control of rules_config_access().

Comments

kjl created an issue. See original summary.

kjl’s picture

Issue summary: View changes
kjl’s picture

Status: Active » Closed (works as designed)

I suppose this is more a consequence of commerce_payment making "event" part of the $conditions sent to overviewTable(), and this issue should be taken up in the commerce issue queue.

Closing.