What's the explanation for my product permission issue in a Drupal Commerce view?

Question

I'm very confused with some permissions and product displays in Views. Maybe you can help me to understand it.

I'm trying to make a view of product displays. In the view I include a relationship for the referenced product field, so I can get fields of the referenced product like for example Image, SKU, price, ...

I save the view, and if I go to the view's page as admin I can see the view correctly, but if I visit the view as authenticated user or anonymous no items are displayed in the view.

So I went to the permissions config page, and I checked the permission "View any product of any type" for anonymous and authenticated users.

After doing so, normal users and anonymous can see the view correctly. But while configuring that permissions it says:

"Warning: Give to trusted roles only; this permission has security implications."

So I do not know if I'm doing things correctly. And I wonder how to make a view of product displays and also get the referenced product fields and make it visible for anonymous and normal users?

Answer 1

Yes, you make right changes to show your commerce views for non-admin users. Here they found that's dummy permission and provide patches, I assume in future commerce versions it will included.

Answer 2

Below is another recommendation to address your "... I went to the permissions config page, and I checked the permission "View any product of any type" for anonymous and authenticated users" ... and your "So I do not know if I'm doing things correctly".

Have a look at the (old) Drupal Commerce issue "Views results empty for unprivileged user when using Relationship: Content: Referenced Product". Especially what's written in comment nr 158, i.e.:

edit your View: > "Advanced" > "Query settings" : check "Disable Query Rewriting"

So instead of granting that permission (so that "normal users and anonymous can see the view correctly", as in your question), it may be sufficient to just adapt these advanced query settings as mentioned above. If it does, it'll be way better then granting that permission with that scary warning.

If you want more info about what the real issue is (and why this is only a work around), then have a look at comment nr 101 of the same issue, which states:

The issue is not with Commerce. It's a node access issue, and it's triggered when you use a Views Relationship with a node access module (such as OG or Domain Access), and there's no related item the user has access to. The quick work-around is to disable SQL rewriting, which allows the view to get all results and ignore the node_access rules -- of course, this will show content the user should not otherwise have access to.