The coupon generate route (/promotion/{commerce_promotion}/coupons/generate) only checks the bulk generate commerce_promotion_coupon permission. Add _entity_access: 'commerce_promotion.update' so generating coupons also requires update access to the promotion, consistent with the add coupon route, which already requires commerce_promotion.update.

Issue fork commerce-3635050

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jsacksick created an issue. See original summary.

jsacksick opened merge request !774

jsacksick’s picture

jsacksick commented
Category: Task » Bug report

  • jsacksick committed 80c4c332 on 3.x 
    fix: #3635050 Check promotion update access on the coupon generate route...
jsacksick’s picture

jsacksick commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.