Skip to content

Commit 527a171

Browse files
aplapanaaplapana
committed
ACP2E-3664: Page Builder's Product component doesn't work if the user doesn't have Widget permission
1 parent bef47c3 commit 527a171

File tree

5 files changed

+183
-7
lines changed

5 files changed

+183
-7
lines changed

‎app/code/Magento/PageBuilder/Model/Stage/Config.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,8 @@ private function getAcl()
223223
{
224224
return [
225225
'template_save' => $this->authorization->isAllowed(self::TEMPLATE_SAVE_RESOURCE),
226-
'template_apply' => $this->authorization->isAllowed(self::TEMPLATE_APPLY_RESOURCE)
226+
'template_apply' => $this->authorization->isAllowed(self::TEMPLATE_APPLY_RESOURCE),
227+
'widget' => $this->authorization->isAllowed('Magento_Widget::widget_instance')
227228
];
228229
}
229230

‎app/code/Magento/PageBuilder/Test/Mftf/Test/AdminPageBuilderProductsCarouselTest/AdminPageBuilderProductsForbiddenEditTest.xml

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright 2025 Adobe
5+
* All Rights Reserved.
6+
*/
7+
-->
8+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
9+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
10+
<test name="AdminPageBuilderProductsForbiddenEditTest">
11+
<annotations>
12+
<features value="PageBuilder"/>
13+
<stories value="Products"/>
14+
<title value="Can't edit products widget"/>
15+
<description value="Clicking products edit widget will display an error."/>
16+
<severity value="MINOR"/>
17+
<useCaseId value="AC-14344"/>
18+
<testCaseId value="ACP2E-3664"/>
19+
<group value="pagebuilder"/>
20+
<group value="pagebuilder-products"/>
21+
<group value="cloud"/>
22+
</annotations>
23+
<before>
24+
<createData entity="_defaultCmsPage" stepKey="createCmsPage"/>
25+
<actionGroup ref="AdminLoginActionGroup" stepKey="loginAsAdmin"/>
26+
<createData entity="PageBuilderProductsSubCategory" stepKey="createPreReqCategory"/>
27+
<createData entity="_defaultProduct" stepKey="createPreReqProduct1">
28+
<requiredEntity createDataKey="createPreReqCategory"/>
29+
</createData>
30+
<createData entity="_defaultProduct" stepKey="createPreReqProduct2">
31+
<requiredEntity createDataKey="createPreReqCategory"/>
32+
</createData>
33+
<amOnPage url="{{AdminCmsPageEditPage.url($$createCmsPage.id$$)}}" stepKey="openEditCmsPage"/>
34+
<actionGroup ref="switchToPageBuilderStage" stepKey="switchToPageBuilderStage"/>
35+
<actionGroup ref="dragContentTypeToStage" stepKey="dragRowToRootContainer">
36+
<argument name="contentType" value="PageBuilderRowContentType"/>
37+
<argument name="containerTargetType" value="PageBuilderRootContainerContentType"/>
38+
</actionGroup>
39+
</before>
40+
<after>
41+
<deleteData createDataKey="createPreReqProduct1" stepKey="deletePreReqProduct1"/>
42+
<deleteData createDataKey="createPreReqProduct2" stepKey="deletePreReqProduct2"/>
43+
<deleteData createDataKey="createPreReqCategory" stepKey="deletePreReqCategory"/>
44+
<deleteData createDataKey="createCmsPage" stepKey="deleteCreateCmsPage"/>
45+
<actionGroup ref="AdminLogoutActionGroup" stepKey="logoutExistingUser"/>
46+
<actionGroup ref="AdminLoginActionGroup" stepKey="loginAsAdminClean"/>
47+
<!--Delete created user-->
48+
<actionGroup ref="AdminDeleteUserActionGroup" stepKey="deleteRestrictedAdmin">
49+
<argument name="user" value="NewAdminUser"/>
50+
</actionGroup>
51+
<actionGroup ref="ClearFiltersAdminDataGridActionGroup" stepKey="clearFilterAfterDeletingNewAdminUser"/>
52+
<!--Delete created user role-->
53+
<actionGroup ref="AdminDeleteCreatedRoleActionGroup" stepKey="deleteRestrictedRole">
54+
<argument name="role" value="adminRole"/>
55+
</actionGroup>
56+
<actionGroup ref="AdminLogoutActionGroup" stepKey="logout"/>
57+
</after>
58+
<actionGroup ref="addPageBuilderPageTitle" stepKey="enterPageTitle">
59+
<argument name="contentType" value="PageBuilderProductsContentType"/>
60+
</actionGroup>
61+
<actionGroup ref="expandPageBuilderPanelMenuSection" stepKey="expandMenuSectionAddContent">
62+
<argument name="contentType" value="PageBuilderProductsContentType"/>
63+
</actionGroup>
64+
<actionGroup ref="dragContentTypeToStage" stepKey="dragProductsIntoStage">
65+
<argument name="contentType" value="PageBuilderProductsContentType"/>
66+
</actionGroup>
67+
<actionGroup ref="openPageBuilderEditPanel" stepKey="openEditAfterDrop">
68+
<argument name="contentType" value="PageBuilderProductsContentType"/>
69+
</actionGroup>
70+
<actionGroup ref="chooseVisualSelectOption" stepKey="chooseSelectProductsBy">
71+
<argument name="property" value="PageBuilderProductsSelectProductsByCondition"/>
72+
</actionGroup>
73+
<actionGroup ref="addConditionToProductConditions" stepKey="addCategory">
74+
<argument name="conditionInput" value="$$createPreReqCategory.id$$"/>
75+
</actionGroup>
76+
<actionGroup ref="saveEditPanelSettings" stepKey="saveEditPanelSettings"/>
77+
<actionGroup ref="exitPageBuilderFullScreen" stepKey="exitPageBuilderFullScreen"/>
78+
<actionGroup ref="SaveAndContinueEditCmsPageActionGroup" stepKey="saveAndContinueEditCmsPage"/>
79+
80+
<!--Create user role with resource access-->
81+
<actionGroup ref="AdminStartCreateUserRoleActionGroup" stepKey="startCreateUserRole">
82+
<argument name="roleName" value="{{adminRole.name}}"/>
83+
<argument name="userPassword" value="{{_CREDS.magento/MAGENTO_ADMIN_PASSWORD}}"/>
84+
<argument name="resourceAccess" value="Custom"/>
85+
<argument name="storeName" value="{{_defaultWebsite.name}}"/>
86+
</actionGroup>
87+
<actionGroup ref="AdminSelectUserRoleResourceActionGroup" stepKey="addCategoryAccess">
88+
<argument name="resourceId" value="Magento_Catalog::categories_anchor"/>
89+
</actionGroup>
90+
<actionGroup ref="AdminSelectUserRoleResourceActionGroup" stepKey="addPageAccess">
91+
<argument name="resourceId" value="Magento_Cms::page_anchor"/>
92+
</actionGroup>
93+
<actionGroup ref="AdminSaveUserRoleActionGroup" stepKey="saveRole"/>
94+
95+
<!--Create user role-->
96+
<actionGroup ref="AdminCreateUserWithRoleActionGroup" stepKey="createRestrictedAdmin">
97+
<argument name="role" value="adminRole"/>
98+
<argument name="user" value="NewAdminUser"/>
99+
</actionGroup>
100+
101+
<!-- Login as newly created admin user -->
102+
<actionGroup ref="AdminLogoutActionGroup" stepKey="logoutFromAdmin"/>
103+
<actionGroup ref="AdminLoginActionGroup" stepKey="loginAsRestrictedAdmin">
104+
<argument name="username" value="{{NewAdminUser.username}}"/>
105+
<argument name="password" value="{{NewAdminUser.password}}"/>
106+
</actionGroup>
107+
108+
<amOnPage url="{{AdminCmsPageEditPage.url($$createCmsPage.id$$)}}" stepKey="openEditCmsPageSecond"/>
109+
<actionGroup ref="switchToPageBuilderStage" stepKey="switchToPageBuilderStage2"/>
110+
<waitForElementVisible selector="{{AdminGridConfirmActionSection.message}}" stepKey="waitForConfirmModal"/>
111+
<see selector="{{AdminGridConfirmActionSection.message}}" userInput="Sorry, you need permissions to view this content." stepKey="seeForbiddenMessage"/>
112+
</test>
113+
</tests>

‎app/code/Magento/PageBuilder/view/adminhtml/web/js/form/element/conditions-loader.js

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,28 @@ define([
1818
data: {
1919
conditions: conditions
2020
}
21-
})
22-
.done(function (response) {
21+
}).done(function (response) {
2322
$conditionsFormPlaceholder.html(response);
2423
window[config.jsObjectName] = new RulesForm(config.jsObjectName, config.childComponentUrl);
2524
$('body').trigger('processStop');
25+
}).fail(function (response) {
26+
if (response.status === 403) {
27+
$('body').notification('clear');
28+
$('body').notification('add', {
29+
error: true,
30+
message: $.mage.__(
31+
'Forbidden. You do not have permission to perform this action.'
32+
),
33+
insertMethod: function (message) {
34+
var $wrapper = $('<div></div>').html(message);
35+
36+
$('.page-main-actions').after($wrapper);
37+
}
38+
});
39+
$('.save.primary').attr('disabled', true);
40+
$('body').trigger('processStop');
41+
}
42+
this.loading(false);
2643
});
2744
};
2845
});

‎app/code/Magento/PageBuilder/view/adminhtml/web/js/form/element/product-totals.js

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,30 @@ define([
6868
superError();
6969
},
7070

71+
/**
72+
* Show upload error message
73+
*/
74+
showForbiddenErrorMessage: function () {
75+
let bodyObj = $('body');
76+
77+
bodyObj.notification('clear');
78+
bodyObj.notification('add', {
79+
error: true,
80+
message: $.mage.__(
81+
'Forbidden. You do not have permission to perform this action.'
82+
),
83+
84+
/**
85+
* @param {String} message
86+
*/
87+
insertMethod: function (message) {
88+
let $wrapper = $('<div></div>').html(message);
89+
90+
$('.page-main-actions').after($wrapper);
91+
}
92+
});
93+
},
94+
7195
/**
7296
* Update product count.
7397
*/
@@ -128,7 +152,13 @@ define([
128152
this.loading(false);
129153
}.bind(this)).fail(function () {
130154
if (this.jqXHR.statusText !== 'abort') {
131-
this.value($t('An unknown error occurred. Please try again.'));
155+
if (this.jqXHR.status === 403) {
156+
this.showForbiddenErrorMessage();
157+
$('.save.primary').attr('disabled', true);
158+
$('body').trigger('processStop');
159+
} else {
160+
this.value($t('An unknown error occurred. Please try again.'));
161+
}
132162
}
133163
this.loading(false);
134164
}.bind(this));

‎app/code/Magento/PageBuilder/view/adminhtml/web/js/form/element/wysiwyg.js

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,9 @@ define([
1111
'Magento_PageBuilder/js/events',
1212
'Magento_Ui/js/lib/view/utils/dom-observer',
1313
'Magento_PageBuilder/js/page-builder',
14+
'Magento_Ui/js/modal/alert',
1415
'Magento_Ui/js/lib/view/utils/async'
15-
], function ($, _, Wysiwyg, $t, events, domObserver, PageBuilder) {
16+
], function ($, _, Wysiwyg, $t, events, domObserver, PageBuilder, alertDialog) {
1617
'use strict';
1718

1819
/**
@@ -67,6 +68,20 @@ define([
6768
* Handle button click, init the Page Builder application
6869
*/
6970
pageBuilderEditButtonClick: function (context, event) {
71+
let aclResource = this.pageBuilder.config?.acl;
72+
73+
if (
74+
aclResource !== undefined &&
75+
aclResource.widget === false &&
76+
aclResource.template_apply !== true &&
77+
aclResource.template_save !== true
78+
) {
79+
return alertDialog({
80+
content: $t('Sorry, you need permissions to view this content.'),
81+
title: $t('Permission Error')
82+
});
83+
}
84+
7085
this.determineIfWithinModal(event.currentTarget);
7186
this.transition(false);
7287

@@ -85,8 +100,8 @@ define([
85100
if (!this.isComponentInitialized()) {
86101
this.loading(true);
87102
this.pageBuilder = new PageBuilder(
88-
this.wysiwygConfigData(),
89-
this.initialValue
103+
this.wysiwygConfigData(),
104+
this.initialValue
90105
);
91106
if (!this.source.get('pageBuilderInstances')) {
92107
this.source.set('pageBuilderInstances', []);

0 commit comments

Comments
 (0)