Support » Plugin: WooCommerce » I think Ive found a bug

I think Ive found a bug

  • Resolved shawfactor

    (@shawfactor)



    4 months ago

    I have found a likely bug that is occurring on several of my sites

    in the file

    wc-user-functions.php

    there are several filters that test current_user_can( ‘shop_manager’ )

    but users can obviouly have more than one role and thi causes problems when someone i both a shop_manager and admin. It should really be:

    if ( current_user_can( ‘shop_manager’ ) && !current_user_can( ‘administrator’ ))

    What do you think

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Andrew

    (@slash1andy)

    Automattic Happiness Engineer

    4 months ago

    Hey there!

    Since the admin users are granted the same permissions as the shop manager (in addition to actual admin stuff), then there’s not a need to specify both roles, since in WordPress you can only have one role per user.

    https://docs.woocommerce.com/document/roles-capabilities/

    Hopefully that helps! Have a great one!

    shawfactor

    (@shawfactor)

    4 months ago

    Incorrect, WordPress supports multiple roles per user, at least architecturally. This functionality is not exposed by default (but there are several plugins that expose an interface to this ability though).

    The fix is simple either ad a test to make sure the user is not a super_admin or use a more appropriate capability check.

    I would appreciate if this bug fix was scheduled for your next release.

    • This reply was modified 4 months ago by  shawfactor.
    Plugin Support Andrew

    (@slash1andy)

    Automattic Happiness Engineer

    4 months ago

    Hey again!

    This isn’t something that I am going to file as a bug report, because, as you mention, it’s not to do with default WordPress behavior.

    If you wanted to submit your line of code as a suggested patch, please do so here: https://github.com/woocommerce/woocommerce/pulls

    Then the developers can look at that and either merge it or deny.

    I’m going to mark this as resolved.

Viewing 3 replies - 1 through 3 (of 3 total)
  • You must be logged in to reply to this topic.

Views