There is no permission to manage your own variation. It's a very big problem. That's why :
- If there is only one variation (it is edited directly on the product's product page), the permission to manage its own products makes sense.
- If there are multiple variations (they are handled outside of the product's product page), the permission to manage its own products makes no sense.
Test with the marketplace:
1) You are "Merchant 1". In your store "Store 1", create a product "Product 1" and several variations.
The variation is accessible with the address:
/product/1/variations/1/edit
2) You are "Merchant 2". In your store "Store 2", create a product "Product 2" and several variations.
The variation is accessible with the address:
/product/2/variations/1/edit
PROBLEM: If you are "Marchand 2" and you access the variation of "Product 1" of "Marchand 1", you can change the variation (price, reference, ...).
| Comment | File | Size | Author |
|---|---|---|---|
| #10 | Capture d’écran du 2019-01-08 22-58-12.png | 288.32 KB | zenimagine |
| #10 | my_variation.png | 297.08 KB | zenimagine |
Comments
Comment #2
drugan commentedComment #4
drugan commentedPlease, check if it works for you now.
UPDATE: note that current solution does not prevent a user who has permission to the /product/2 to edit a variation which belongs to /product/1 if he has access to the product. Just because anyway this user can do this in a normal UI but if he wants to make such weird manual URL constructing then we also should allow it for him.
Comment #5
zenimagine commented@drugan Thank you, it works.
But if I access this page
/product/2/variationsI can duplicate a variation and add new ones.The merchant can in some cases have a hidden field.
Comment #7
drugan commentedPlease, check create variation access on a product which the current user is not an owner OR has not access to manage the product variation type.
Comment #8
zenimagine commented@drugan Sorry but I do not understand your answer
Comment #9
drugan commented@zenimagine
Please, check if changes on the last commit
https://www.drupal.org/project/commerce_marketplace/issues/3024187#comme...
...fixed this your issue: https://www.drupal.org/project/commerce_marketplace/issues/3024187#comme...
Comment #10
zenimagine commented@drugan I do not know what you mean. Here are screenshots of a variation that is mine and a variation that is not mine.
Comment #11
drugan commentedWhat I mean before the #6 commit you might do the following:
As the result the newly added variation appears on the product/2/variations page to which the owner of the product/1 has no access! Why is that possible because the owner of the product/1 has manage COMMON_TYPE commerce_product_variation permission which is also used by the product/2
As for your screenshots I also can't understand what you want to achieve. Disable Duplicate action for the current user? There is no such a granular variation type permission like duplicate COMMON_TYPE commerce_product_variation, update COMMON_TYPE commerce_product_variation, delete COMMON_TYPE commerce_product_variation, etc.. Only manage COMMON_TYPE commerce_product_variation.
The plan is to add such permissions to the commerce_bulk module as it handles variation type actions and has Variation.php class overriden in its code. Will be done as soon as I have time (or paid support) for this work:
https://www.drupal.org/project/commerce_bulk/issues/3023578#comment-1291...
Comment #12
zenimagine commented@drugan I thought this should be done in the Commerce module, because the "Update own products" permission has no interest if it is not applied to variations of the parent product.
Regarding the funding of this module, it will be a pleasure to contribute, once my site is finished and when I start to generate money ;-)
Comment #13
drugan commented@zenimagine
I agree with you: a lot of the stuff that is implemented in the commerce_marketplace should be done in the Drupal Commerce. Earlier I've made a bunch of patches to the DC but unfortunately no one of those was accepted. You should be in the ,,team,, in order to contribute to the DC. As it was said by @boyanz in some comment "We don't ask for patches...". What they need just test a code, report bugs and wait patiently until (if at all) they'll decide to fix an issue. ...and you should not blame them because the whole Drupal Commerce is exactly what they require in their own projects. Again, the @boyanz quote: "the code is free but the coding is not." If someone pays them - they do changes in the DC.
Me personally gave up contributing to the DC. As I think it's a worthless waist of time. Better solution is to create your own module and do there whatever you want.
Anyway, you can try your luck. I'd even don't mind if you copy snippets from the commerce_marketplace code which fix some DC bugs and suggest a patch for them. If they will accept that then the commerce_marketplace will become slimmer and easier to maintain :).
PS: Yes, funding can boost development but what I need the most is contribution to the module. That will make it more useful and robust. BTW, thank you for your activity on the module - I really appreciate it. Let's hope that in the future here will come more contributors like you.
Comment #14
drugan commented