The "Move to wishlist" view button that can be added to the cart view (and possibly elsewhere?) does not check the "access wishlist" permission before displaying the button.

This means that anon users can add items to a wishlist they cannot access.

CommentFileSizeAuthor
#4 3137162-4.patch3.42 KBalexdoma
#2 check-permission-for-move-to-cart-button-3137162-2.patch1.44 KBrhovland

Issue fork commerce_wishlist-3137162

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

rhovland created an issue. See original summary.

rhovland’s picture

rhovland
he/him
Primary language English
Location Oregon
commented
StatusFileSize
new check-permission-for-move-to-cart-button-3137162-2.patch1.44 KB

Patch based off of https://www.drupal.org/project/commerce_wishlist/issues/3045799

Not sure if this is the correct way to do this, but it works.

rhovland’s picture

rhovland
he/him
Primary language English
Location Oregon
commented
Status: Active » Needs review
alexdoma’s picture

alexdoma commented
StatusFileSize
new 3137162-4.patch3.42 KB

re-roll patch

vmarchuk made their first commit to this issue’s fork.

vmarchuk opened merge request !12

vmarchuk’s picture

vmarchuk
Primary language English
Location Rivne, UA
commented
Status: Needs review » Reviewed & tested by the community

Added a small fix for Drupal coding standards and opened MR.
+1 to RTBC

jsacksick made their first commit to this issue’s fork.

  • jsacksick committed 7e73c8bd on 8.x-3.x authored by vmarchuk 
    Issue #3137162 by vmarchuk, rhovland, alexdoma: Move to wishlist view...
jsacksick’s picture

jsacksick commented
Status: Reviewed & tested by the community » Fixed

Merged, thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.