1

The SA-CONTRIB-2020-020 security patch was titled "Further restrict anonymous user access to anonymous orders."

Unfortunately it seems to have broken some sites I work on. We are now seeing access denied errors on admin/commerce/orders/xxx for "semi-trusted" users who have permission "Default: Update orders". For these sites the security patch was a non-back-compatible change and I have raised an issue for that.

The solution that worked for me is to grant the semi-trusted users the "access commerce administration pages" permission.

However I am nervous because this permission doesn't seem to have clear documentation. I don't wish for these "semi-trusted" users to suddenly gain extra access that they should not have such as to edit products.

Please can anyone confirm the effects of this permission? Does it do nothing alone and only work if other permissions are added?

Improve this question
5
  • 2
    I’m voting to close this question because it's a bug report that must be reported to the issue queue on drupal.org to be fixed.
    – leymannx
    Commented Jun 20, 2020 at 18:57
  • Agreed, please move this to the issue queue, though I'm not even sure it's a bug so much as a feature or documentation request? Re: clearer communication, it's pretty common practice not to be overly specific in SA's to protect users while their upgrades are pending.
    – Ryan Szrama
    Commented Jun 21, 2020 at 20:12
  • That's fine I'm very happy to raise an issue thanks for the guidance on the appropriate approach.
    – AdamS
    Commented Jun 22, 2020 at 8:38
  • 1
    OK I have raised an issue. The remaining question still seems valid - "please can anyone confirm the effects of this permission".
    – AdamS
    Commented Jun 22, 2020 at 15:04
  • 1
    You might consider rephrasing the question title, this maybe helps to get to the point more quickly.
    – leymannx
    Commented Jun 22, 2020 at 19:48

1 Answer 1

Reset to default
0

Does it do nothing alone and only work if other permissions are added?

Currently, yes (although that could theoretically change in the future).

The permission is added to all HTML admin routes for the order entity type (add/edit/etc), and for admin overview pages, which essentially list sub-pages that the user has access to.

If the user doesn't have access to those sub-pages, all provided by separate permissions, they won't see the links, and won't be able to visit them. Similarly, if they don't have the correct entity access permission, they won't be able to perform the respective operation on the entity.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.