There is no permission to manage your own variation. It's a very big problem. That's why :

- If there is only one variation (it is edited directly on the product's product page), the permission to manage its own products makes sense.
- If there are multiple variations (they are handled outside of the product's product page), the permission to manage its own products makes no sense.

Test with the marketplace:

1) You are "Merchant 1". In your store "Store 1", create a product "Product 1" and several variations.
The variation is accessible with the address:

/product/1/variations/1/edit

2) You are "Merchant 2". In your store "Store 2", create a product "Product 2" and several variations.
The variation is accessible with the address:

/product/2/variations/1/edit

PROBLEM: If you are "Marchand 2" and you access the variation of "Product 1" of "Marchand 1", you can change the variation (price, reference, ...).

https://www.drupal.org/project/commerce/issues/3010914

Comments

zenimagine created an issue. See original summary.

drugan’s picture

Title: Add permissions to manage my own variations » Add handler to not allow access to variations which do NOT belong to their parent product

  • drugan committed bcbccc0 on 8.x-1.x
    Issue #3024187 by zenimagine: Add handler to not allow access to...
drugan’s picture

Please, check if it works for you now.

UPDATE: note that current solution does not prevent a user who has permission to the /product/2 to edit a variation which belongs to /product/1 if he has access to the product. Just because anyway this user can do this in a normal UI but if he wants to make such weird manual URL constructing then we also should allow it for him.

zenimagine’s picture

@drugan Thank you, it works.
But if I access this page /product/2/variations I can duplicate a variation and add new ones.
The merchant can in some cases have a hidden field.

  • drugan committed 680d2d3 on 8.x-1.x
    Issue #3024187 by zenimagine, drugan: Add handler to not allow CREATE...
drugan’s picture

Please, check create variation access on a product which the current user is not an owner OR has not access to manage the product variation type.

zenimagine’s picture

@drugan Sorry but I do not understand your answer

drugan’s picture

zenimagine’s picture

StatusFileSize
new297.08 KB
new288.32 KB

@drugan I do not know what you mean. Here are screenshots of a variation that is mine and a variation that is not mine.

drugan’s picture

What I mean before the #6 commit you might do the following:

  1. visit product/1/variations page
  2. press Add new variation button
  3. the form is opened on the product/1/variations/add page
  4. edit the URL in the address bar to product/2/variations/add
  5. press ENTER or RETURN key to refresh the page
  6. make required changes on the variation form and press Save button

As the result the newly added variation appears on the product/2/variations page to which the owner of the product/1 has no access! Why is that possible because the owner of the product/1 has manage COMMON_TYPE commerce_product_variation permission which is also used by the product/2

As for your screenshots I also can't understand what you want to achieve. Disable Duplicate action for the current user? There is no such a granular variation type permission like duplicate COMMON_TYPE commerce_product_variation, update COMMON_TYPE commerce_product_variation, delete COMMON_TYPE commerce_product_variation, etc.. Only manage COMMON_TYPE commerce_product_variation.

The plan is to add such permissions to the commerce_bulk module as it handles variation type actions and has Variation.php class overriden in its code. Will be done as soon as I have time (or paid support) for this work:

https://www.drupal.org/project/commerce_bulk/issues/3023578#comment-1291...

zenimagine’s picture

@drugan I thought this should be done in the Commerce module, because the "Update own products" permission has no interest if it is not applied to variations of the parent product.

Regarding the funding of this module, it will be a pleasure to contribute, once my site is finished and when I start to generate money ;-)

drugan’s picture

@zenimagine

I agree with you: a lot of the stuff that is implemented in the commerce_marketplace should be done in the Drupal Commerce. Earlier I've made a bunch of patches to the DC but unfortunately no one of those was accepted. You should be in the ,,team,, in order to contribute to the DC. As it was said by @boyanz in some comment "We don't ask for patches...". What they need just test a code, report bugs and wait patiently until (if at all) they'll decide to fix an issue. ...and you should not blame them because the whole Drupal Commerce is exactly what they require in their own projects. Again, the @boyanz quote: "the code is free but the coding is not." If someone pays them - they do changes in the DC.

Me personally gave up contributing to the DC. As I think it's a worthless waist of time. Better solution is to create your own module and do there whatever you want.

Anyway, you can try your luck. I'd even don't mind if you copy snippets from the commerce_marketplace code which fix some DC bugs and suggest a patch for them. If they will accept that then the commerce_marketplace will become slimmer and easier to maintain :).

PS: Yes, funding can boost development but what I need the most is contribution to the module. That will make it more useful and robust. BTW, thank you for your activity on the module - I really appreciate it. Let's hope that in the future here will come more contributors like you.

drugan’s picture

Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.