Issue #2478141 - Non admin users can see admin/commerce/products

drupalcommerce · Apr 27, 2015 · 8086aab · 8086aab
1 parent 8918073
commit 8086aab
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 16 deletions.
diff --git a/modules/product/config/install/views.view.commerce_products.yml b/modules/product/config/install/views.view.commerce_products.yml
@@ -1,9 +1,9 @@
-uuid: 21999112-ce61-45c2-b306-6ee3864956df
 langcode: en
 status: true
 dependencies:
   module:
     - commerce_product
+    - user
 id: commerce_products
 label: Products
 module: views
@@ -20,8 +20,9 @@ display:
     position: 0
     display_options:
       access:
-        type: none
-        options: {  }
+        type: perm
+        options:
+          perm: 'administer products'
       cache:
         type: none
         options: {  }
@@ -381,17 +382,6 @@ display:
       display_extenders: {  }
     cache_metadata:
       contexts:
-        - languages
-      cacheable: false
-  page_1:
-    display_plugin: page
-    id: page_1
-    display_title: Page
-    position: 1
-    display_options:
-      display_extenders: {  }
-      path: admin/commerce/products
-    cache_metadata:
-      contexts:
-        - languages
+        - 'languages:language_content'
+        - 'languages:language_interface'
       cacheable: false
diff --git a/modules/product/src/Tests/ProductAdminTest.php b/modules/product/src/Tests/ProductAdminTest.php
@@ -151,4 +151,25 @@ protected function testAddCommerceProductFieldAdmin() {
 
     return $fields;
   }
+
+  /**
+   * Tests that anonymous users cannot see the admin/commerce/products page.
+   */
+  protected function testAdminCommerceProducts() {
+    // First test that the current admin user can see the page
+    $this->drupalGet('admin/commerce/products');
+    $this->assertResponse(200);
+    $this->assertNoText("You are not authorized to access this page.");
+    $this->assertLink("Add a new product");
+
+    // Logout and check that anonymous users cannot see the products page
+    // and receieve a 403 error code.
+    $this->drupalLogout();
+
+    $this->drupalGet('admin/commerce/products');
+    $this->assertResponse(403);
+    $this->assertText("You are not authorized to access this page.");
+    $this->assertNoLink("Add a new product");
+  }
+
 }