Hiding path in shop templates

Next topic

Author	Message
Richard Lundberg	Monday 16 August 2010 4:32:08 pm I want to turn off the path display in certain shop views, in particular customerorderview and orderview in order to prevent a customer having access to the entire order list of all customers. (I have enabled shop/adminstrate rights to customers so they can review their orders, but this gives the access to view all orders!!) I have added {set scope=global persistent_variable=hash('left_menu', false(), 'extra_menu', false(), 'show_path', false())} to the top of the customerorderview.tpl template as this seems to be the method via ezpagedata() used by the frontpage template to turn of the path, but it does not seem to work for the shop template. This is on 4.3 Any ideas? www.peakm3.com
Peter Keung	Friday 27 August 2010 9:42:56 am Have you tried ezpagedata_set? However, even if you disable the link to the full order list, people can still access the URL directly. And even without "administrate" rights, it's easy to manipulate the shop/orderview/<order_number> URL to view other orders. Some workarounds for this privacy issue I've used in the past include building separate views or creating override templates with hack-ish permission checking. http://www.mugo.ca Mugo Web, eZ Partner in Vancouver, Canada

Author

Message

Monday 16 August 2010 4:32:08 pm

I want to turn off the path display in certain shop views, in particular customerorderview and orderview in order to prevent a customer having access to the entire order list of all customers.

(I have enabled shop/adminstrate rights to customers so they can review their orders, but this gives the access to view all orders!!)

I have added

{set scope=global persistent_variable=hash('left_menu', false(),
'extra_menu', false(),
'show_path', false())}

to the top of the customerorderview.tpl template as this seems to be the method via ezpagedata() used by the frontpage template to turn of the path, but it does not seem to work for the shop template.

This is on 4.3

Any ideas?

www.peakm3.com

Peter Keung

Friday 27 August 2010 9:42:56 am

Have you tried ezpagedata_set?

However, even if you disable the link to the full order list, people can still access the URL directly. And even without "administrate" rights, it's easy to manipulate the shop/orderview/<order_number> URL to view other orders. Some workarounds for this privacy issue I've used in the past include building separate views or creating override templates with hack-ish permission checking.

http://www.mugo.ca
Mugo Web, eZ Partner in Vancouver, Canada

eZ debug

Timing:	Jan 18 2025 11:03:42
Script start
Timing:	Jan 18 2025 11:03:42
Module start 'layout'
Timing:	Jan 18 2025 11:03:42
Module start 'content'
Timing:	Jan 18 2025 11:03:43
Module end 'content'
Timing:	Jan 18 2025 11:03:43
Script end

Main resources:

Total runtime	1.0219 sec
Peak memory usage	4,096.0000 KB
Database Queries	54

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0062	591.7656	152.6250
Module start 'layout'	0.0062	0.0027	744.3906	39.4453
Module start 'content'	0.0089	1.0113	783.8359	532.6406
Module end 'content'	1.0202	0.0016	1,316.4766	8.1641
Script end	1.0219		1,324.6406

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0035	0.3408	16	0.0002
Check MTime	0.0014	0.1378	16	0.0001
Mysql Total
Database connection	0.0013	0.1235	1	0.0013
Mysqli_queries	0.9733	95.2446	54	0.0180
Looping result	0.0005	0.0521	52	0.0000
Template Total	0.9888	96.8	2	0.4944
Template load	0.0023	0.2231	2	0.0011
Template processing	0.9865	96.5377	2	0.4933
Template load and register function	0.0001	0.0115	1	0.0001
states
state_id_array	0.0007	0.0728	1	0.0007
state_identifier_array	0.0008	0.0811	2	0.0004
Override
Cache load	0.0019	0.1822	17	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0008	0.0785	2	0.0004
Fetch class attribute name	0.0008	0.0802	4	0.0002
XML
Image XML parsing	0.0010	0.0997	2	0.0005
class_abstraction
Instantiating content class attribute	0.0000	0.0006	4	0.0000
General
dbfile	0.0023	0.2232	23	0.0001
String conversion	0.0000	0.0008	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
2	content/datatype/view/ezimage.tpl	<No override>	extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tpl
2	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
3	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
1	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 10 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs