1

The SA-CONTRIB-2020-020 security patch was titled "Further restrict anonymous user access to anonymous orders."

Unfortunately it seems to have broken some sites I work on. We are now seeing access denied errors on admin/commerce/orders/xxx for "semi-trusted" users who have permission "Default: Update orders". For these sites the security patch was a non-back-compatible change and I have raised an issue for that.

The solution that worked for me is to grant the semi-trusted users the "access commerce administration pages" permission.

However I am nervous because this permission doesn't seem to have clear documentation. I don't wish for these "semi-trusted" users to suddenly gain extra access that they should not have such as to edit products.

Please can anyone confirm the effects of this permission? Does it do nothing alone and only work if other permissions are added?

  • 2
    I’m voting to close this question because it's a bug report that must be reported to the issue queue on drupal.org to be fixed. – leymannx Jun 20 at 18:57
  • Agreed, please move this to the issue queue, though I'm not even sure it's a bug so much as a feature or documentation request? Re: clearer communication, it's pretty common practice not to be overly specific in SA's to protect users while their upgrades are pending. – Ryan Szrama Jun 21 at 20:12
  • That's fine I'm very happy to raise an issue thanks for the guidance on the appropriate approach. – AdamS Jun 22 at 8:38
  • 1
    OK I have raised an issue. The remaining question still seems valid - "please can anyone confirm the effects of this permission". – AdamS Jun 22 at 15:04
  • 1
    You might consider rephrasing the question title, this maybe helps to get to the point more quickly. – leymannx Jun 22 at 19:48
0

Does it do nothing alone and only work if other permissions are added?

Currently, yes (although that could theoretically change in the future).

The permission is added to all HTML admin routes for the order entity type (add/edit/etc), and for admin overview pages, which essentially list sub-pages that the user has access to.

If the user doesn't have access to those sub-pages, all provided by separate permissions, they won't see the links, and won't be able to visit them. Similarly, if they don't have the correct entity access permission, they won't be able to perform the respective operation on the entity.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.