Multi-shop permission fixes #4872
Conversation
for "products/updateProductField" method
permission check
Meteor method
Ensure we can only toggle the package for the shop for which the user has permission
Now ensures that the modified tags cannot belong to a different shop from that which you have permission for.
| if (!Reaction.hasPermission("createProduct")) { | ||
| throw new ReactionError("access-denied", "Access Denied"); | ||
| } | ||
|
|
||
| // Check first if Product exists and then if user has the right to alter it |
There was a problem hiding this comment.
Why do we check for the Product first, and then permissions? Should a user without permissions be allowed to know if a product exists or not?
There was a problem hiding this comment.
Good question. It's definitely best practice to avoid giving clues to existence for something like querying if a user with a certain email exists. In this case, though, the product ID is public information so we're not really revealing anything. The reason we look up the product first, is because we need product.shopId in order to do the permission check for the correct shop. We can't even do a permission check if we don't have a product. We could still choose to throw a less informative error, but as I said in this case we're not really revealing anything.
There was a problem hiding this comment.
👍 Makes sense, thanks for the clarification.
|
@aldeed This is pretty much good to go, just had one question, see above. |
Impact: minor
Type: bugfix
Issues
currenciesproperty of the primary shop.rateproperties in thecurrenciesproperty of the primary shop.Solutions
Breaking changes
Custom code relying on the removed Meteor methods will break.
Testing
To call Meteor methods from a browser, connect to localhost:3000, open the browser console, and enter
Meteor.call("methodName", /* all necessary args */, console.log.bind(console)). By passingconsole.logas the callback function, it will be sure to log the results and/or error when it's done.