Describe your bug or feature request.

Getting access denied while trying to set a customer's default payment method as an administrator:

Path: /user/5653/payment-methods/1326/set-default?token=[token-stripped]. Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException: in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 117 of /code/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).

If a bug, provide steps to reproduce it from a clean install.

Enable all payment method permissions for admin, and try to set another user's default payment method as an admin.

CommentFileSizeAuthor
#5 commerce-payment-method-set-default-access.patch2.38 KBtonytheferg

Issue fork commerce-3625251

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

tonytheferg created an issue. See original summary.

jsacksick’s picture

jsacksick commented

Reading PaymentMethodAccessControlHandler, if the user setting the default payment method has the "update any commerce_payment_method" permission, or the "administer commerce_payment_method" permission, the opration should be allowed, see below:

    $any_result = AccessResult::allowedIfHasPermissions($account, [
      "$operation any commerce_payment_method",
      $this->entityType->getAdminPermission(),
    ], 'OR');

    if ($any_result->isAllowed()) {
      return $any_result;
    }
jsacksick’s picture

jsacksick commented
Status: Active » Postponed (maintainer needs more info)

Haven't tried this myself, but any chance you can test granting the right permissions and get back to us?

tonytheferg’s picture

tonytheferg commented
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Active

Yes, all permissions are enabled for admin. Sorry I left that out. Added that to steps to reproduce.

tonytheferg’s picture

tonytheferg commented
StatusFileSize
new commerce-payment-method-set-default-access.patch2.38 KB

Patch per Claude. Didn't have time to create an MR. Have a look when you get time. Thanks!

jsacksick’s picture

jsacksick commented

An MR would be preferable if possible :).

tonytheferg’s picture

tonytheferg commented

I know. Sorry. I'd have to switch my env. to dev, etc, and I don't have that set up currently. Sorry. Hopefully I've provided some help.

tbkot made their first commit to this issue’s fork.

jsacksick’s picture

jsacksick commented
Status: Active » Closed (duplicate)

Closing this in favor of #3576243: Do not allow "Mark as default" operation for the expired or non-reusable payment method.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.