Describe your bug or feature request.

/admin/commerce/product-attributes/manage/{attribute}/translate gives 403 Access denied pages to content editors unless we give them "translate configuration" permission. Giving that permission to them is not a good solution because that way we also enable access to other translating-related core administration form pages such as /admin/config/regional/config-translation and /admin/config/regional/translate.

If a bug, provide steps to reproduce it from a clean install.

1. install commerce, so that you can create products and product attributes
2. enable the 4 Drupal Drupal core translation-related modules
3. add another language to Drupal
4. enable translations for product attributes, products, product variations
5. create a content administrator user role that
6. try to set permissions so that with this role users could be able to manage products, variations, orders and product attributes
7. create a user with that role
8. login with this user
9. try to add product attributes and translations to the product attributes.
10. instead of the attributes' translation form, you should see Access denied

CommentFileSizeAuthor
#10 interdiff_7_10.txt2.87 KBtbkot
#10 3278337-10.patch10.08 KBtbkot
#7 3278337-7.patch10.1 KBtbkot

Issue fork commerce-3278337

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

kaszarobert created an issue. See original summary.

kaszarobert’s picture

kaszarobert
Primary language Hungarian
commented

The problem is that before the product attribute translation overview and form ConfigTranslationOverviewAccess::doCheckAccess, core config_translation module checks this:

    $access =
      $account->hasPermission('translate configuration') &&
      $mapper->hasSchema() &&
      $mapper->hasTranslatable() &&
      (!$source_language || !$source_language->isLocked());

I'm not sure how this could be replaced or overridden.

luksak’s picture

luksak
he/him
commented

I have the same issue. @kaszarobert did you come up with a solution for this?

kaszarobert’s picture

kaszarobert
Primary language Hungarian
commented

Not really. Frankly, we didn't mess around with that and we simply gave that permission to the shop owners and told them, that they should edit only product, order, content, taxonomy forms and leave the rest of the settings pages alone, and they did that.

tBKoT made their first commit to this issue’s fork.

tBKoT opened merge request !249

tbkot’s picture

tbkot commented
StatusFileSize
new 3278337-7.patch10.1 KB

Patch with changes from MR. To add access for users to translate product attributes add the "Translate product attribute" permission

tbkot’s picture

tbkot commented
Status: Active » Needs review
jsacksick’s picture

jsacksick commented
Status: Needs review » Needs work 
  1. +++ b/modules/product/commerce_product.module
@@ -377,3 +377,27 @@ function commerce_product_field_group_content_element_keys_alter(&$keys) {
+function commerce_product_entity_operation_alter(array &$operations, EntityInterface $entity): void {

    Do we really need this? Isn't the access automatically checked for the route? 

  2. +++ b/modules/product/commerce_product.module
@@ -377,3 +377,27 @@ function commerce_product_field_group_content_element_keys_alter(&$keys) {
+  // operation is not exist we need to check if the user has access to manage

    is not exist -> does not exist.

  3. +++ b/modules/product/commerce_product.permissions.yml
@@ -2,3 +2,8 @@
+'translate product attribute':

    perhaps we should make this:
    translate "commerce_product_attribute"
    to match "administer commerce_product_attribute".

    I don't really see places where we just drop the prefix. 

  4. +++ b/modules/product/src/ConfigTranslation/ProductAttributeMapper.php
@@ -24,7 +26,42 @@ class ProductAttributeMapper extends ConfigEntityMapper {
+  private function addTranslationFormAccessCheck(Route &$route): void {

    In general, we prefer protected methods to allow for overrides in commerce core / contrib... I know it's tempting to add private methods, but... that isn't what we usually do :).

tbkot’s picture

tbkot commented
Status: Needs work » Needs review
StatusFileSize
new 3278337-10.patch10.08 KB
new interdiff_7_10.txt2.87 KB

@jsacksick

1. We need to check access to the URL before adding it to the operation list, in another case users without access to this page would see the link but the page will return an access denied exception
2. Fixed
3. Permission renamed to "translate commerce_product_attribute"
4. Fixed

  • jsacksick committed 12720cd0 on 8.x-2.x authored by tBKoT 
    Issue #3278337 by tBKoT, kaszarobert, Lukas von Blarer, jsacksick:...

  • jsacksick committed bb9467fb on 3.0.x authored by tBKoT 
    Issue #3278337 by tBKoT, kaszarobert, Lukas von Blarer, jsacksick:...
jsacksick’s picture

jsacksick commented
Status: Needs review » Fixed

Committed, thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

jsacksick closed merge request !249