Fixing the permissions for user access to Order List

Monday 22 January 2007 5:26:45 am

EzPublish 3.9 has a problem showing "my orders" from the user profile without granting admin privileges. This means that the user can see ALL of the orders in the system.

In order to fix this I have modified the source code to correct the problem by adding a new rule to the shop's module.php to control access to the customerorderview function.

If you need to fix this follow these instructions.

Add "user_view_orders" into the access function

Change...

$ViewList["customerorderview"] = array(
    "functions" => array( 'administrate' ),
    "script" => "customerorderview.php",
    "default_navigation_part" => 'ezshopnavigationpart',
    "params" => array( "CustomerID", "Email" ) );

To this...

$ViewList["customerorderview"] = array(
    "functions" => array(   'user_view_orders', 'administrate' ),
    "script" => "customerorderview.php",
    "default_navigation_part" => 'ezshopnavigationpart',
    "params" => array( "CustomerID", "Email" ) );

Then add ?$FunctionList['user_view_orders'] = array( );? to the bottom of the file.

Change...

$FunctionList['setup'] = array( );
$FunctionList['administrate'] = array( );
$FunctionList['buy'] = array( );
$FunctionList['edit_status'] = array( );
$FunctionList['setstatus'] = array( 'FromStatus' => $FromStatus,
                                    'ToStatus' => $ToStatus );

To this...

$FunctionList['setup'] = array( );
$FunctionList['administrate'] = array( );
$FunctionList['buy'] = array( );
$FunctionList['edit_status'] = array( );
$FunctionList['setstatus'] = array( 'FromStatus' => $FromStatus,
                                    'ToStatus' => $ToStatus );
$FunctionList['user_view_orders'] = array( );

Then go to the Roles and Policies and add the shop / user_view_orders to the users permissions and your good to go.

Regards
Fats

-- Stuart

stuart@grandmore.com
http://www.grandmore.com

Monday 22 January 2007 6:44:50 am

It is related however the standard install of ezPublish 3.9 has the "My Profile" functionality in place during installation. It does not however work out of the box as there are no roles to allow a user to see only their orders.

I did look at the contribution but decided it was better top fix ez than add another extension. Also the extension works slightly differently to that of ez 3.9

Regards
Fats

-- Stuart

stuart@grandmore.com
http://www.grandmore.com

Friday 16 March 2007 6:57:30 pm

Stuart,

Would you consider submitting a feature request (to the issue system) with a diff which adds your fix?

Perhaps with a little more work eZ systems might consider adding this feature to the default release.

Then no need to patch in the future for everyone. Here my diff based on your instructions ...

# diff kernel/shop/module.php kernel/shop/module.php.patched
86c86
<     "functions" => array( 'administrate' ),
---
>     "functions" => array( 'user_view_orders','administrate' ),
327a328
> $FunctionList['user_view_orders'] = array( );

//kracker

Member since: 2001.07.13 || http://ezpedia.se7enx.com/

Monday 06 October 2008 5:45:23 am

It's quite unbelievable that this issue is not fixed with 4.0.1.
Nobody wants any user to see the orders of other users (except for administator users), I guess.
So why is the limitation of orderlist to orders of the current user not the default setting?

---------------------------------------
http://www.lbm-services.de