0

I've created a view based on order products in ubercart, but only those with admin role, who have permissions to see all orders can see the view.

Now this is problematic, as the view is a most popular products grid, which is meant for anonymous users who visit the webshop.

My question is: can I somehow restrict access to anonymous and authenticated users to see all the orders but at the same time allow them to see that one view, based on order products?

Hope my question was clear, and thanks in advance,

Huba

0

In the view's advanced settings, go to 'SQL Settings', and check 'Disable SQL rewriting'.

Drupal modules can hook in to SQL queries and alter them before they are executed. The Ubercart module automatically adds a permission check to queries that touch the Order table, to implement the 'view own orders' permission. Individual views can opt out of this rewriting mechanism, but that will prevent any module from altering the query. Be sure to thoroughly test that the view does not leak any sensitive information.

  • Thank you! It was just what I was looking for! Yes, I got the Drupal warning, do you suggest, that simply making sure, that no field containing sensitive information is added to the view? Can you give me some hints, as to what else to look for, if there's something else? Thank you again! – Huba Gáspár Oct 23 '15 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.