Currently, if you have access to view unpublished variations, when you view an Add to Cart form that either lists variations or presents attribute options, these lists will always include any unpublished variations.

As a feature, this is interesting because it lets you include variations that the general public may not be able to purchase but would be purchaseable by an admin. However, there's no indication in the UI that some are published vs. unpublished (the privileged user just has to know), and there's no way to disable the functionality if you don't want it. This ticket is about solving that latter use case.

I'd like to see the "Product variation title" and "Product variation attributes" widgets have an additional option added, a checkbox that reads:

[ ] Filter options for unpublished variations out of select lists.
Edit: See suggestion in #5 to better use:
[ ] Show unpublished variations (unchecked by default)

I don't normally like toggling a checkbox on to disable something, but I think regarding this as enabling a filter is alright. This simplifies the upgrade path, as the absence of a value would be treated as the disabling of the filter.

Issue fork commerce-3572669

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

rszrama created an issue. See original summary.

mikemccaffrey made their first commit to this issue’s fork.

mikemccaffrey changed the visibility of the branch 3572669-quick-fix to hidden.

rhovland’s picture

rhovland
he/him
Primary language English
Location Oregon
commented

+1 on this being needed.

I ran into the consequences of this change when I updated from 8.x-2.x to 3.x
#3167716: Unpublished variations are not properly checked for access

In my case I was already using a variation filter subscriber so I filtered out unpublished variations there as a temp fix but this needs to be added for everyone else that is using stock commerce without custom code.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Issue summary: View changes

I agree this makes a lot of sense for solving #3167716: Unpublished variations are not properly checked for access

Still

Filter options for unpublished variations out of select lists.

is not the right way around in Drupal. Drupal follows a security-by-design concept so filtering out unpublished variations should definitely be the default!

Show unpublished variations (unchecked by default) is the correct implementation in Drupal IMHO.
Furthermore, it needs a description to tell details and who can see these unpublished variations then!

tbkot made their first commit to this issue’s fork.

tbkot opened merge request !657

tbkot’s picture

tbkot commented
Status: Active » Needs review
zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented
Status: Needs review » Needs work
zaporylie’s picture

zaporylie
he/him
Primary language Polish
commented
Status: Needs work » Needs review

AFAIK this one is "Needs review". I rerolled the MR but haven't review it myself.

jsacksick’s picture

jsacksick commented
Status: Needs review » Needs work

Thanks for working on this. I reviewed MR !657, and I'd like a few changes before it can go in:

  1. Behavior change on update. ProductVariationStorage::loadEnabled() already filters variations by view access, so customers never see unpublished variations today. The only users who see them are users who are allowed to view unpublished variations (e.g. administrators). Since show_unpublished defaults to FALSE, existing sites would silently stop showing them to those users after updating. Could we add an update hook that sets show_unpublished: TRUE on existing form displays using these widgets, so the current behavior is preserved and the filtering is opt-in for existing sites?
  2. The setting needs a description. Something like: "Unpublished variations are only shown to users with permission to view them (e.g. administrators). Customers never see them, regardless of this setting." Without it, the setting reads as if it could expose unpublished variations to customers.
  3. Please keep hide_single out of this MR. Moving it to ProductVariationWidgetBase exposes the setting on every widget extending the base class (including contrib/custom ones that don't implement it), and changes the config schema. That's a separate change; if we want it, let's open a follow-up issue.

Also, the issue mentions that there's no visual cue distinguishing unpublished variations when they are shown. That isn't addressed here. Fine to handle in a follow-up, but worth noting.