Skip to content

Commit 8a091cc

Browse files
engcom-Echoengcom-Echo
committed
MC-34156: Cannot save product in store view scope without Magento_Catalog::edit_product_design ACL
1 parent 68c903f commit 8a091cc

File tree

2 files changed

+171
-1
lines changed

2 files changed

+171
-1
lines changed

‎app/code/Magento/Catalog/Controller/Adminhtml/Product/Initialization/Helper/AttributeFilter.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ private function prepareDefaultData(array $attributeList, string $attributeCode,
8080
// For non-numeric types set the attributeValue to 'false' to trigger their removal from the db
8181
if ($attributeType === 'varchar' || $attributeType === 'text' || $attributeType === 'datetime') {
8282
$attribute->setIsRequired(false);
83-
$productData[$attributeCode] = false;
83+
$productData[$attributeCode] = $attribute->getDefaultValue() ?: false;
8484
} else {
8585
$productData[$attributeCode] = null;
8686
}

‎dev/tests/integration/testsuite/Magento/Catalog/Model/Product/AuthorizationTest.php

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\Catalog\Model\Product;
9+
10+
use Laminas\Stdlib\Parameters;
11+
use Magento\Catalog\Api\ProductRepositoryInterface;
12+
use Magento\Catalog\Controller\Adminhtml\Product\Initialization\Helper;
13+
use Magento\Catalog\Model\Product;
14+
use Magento\Framework\App\Request\Http as HttpRequest;
15+
use Magento\Framework\Exception\AuthorizationException;
16+
use Magento\Framework\ObjectManagerInterface;
17+
use Magento\TestFramework\Helper\Bootstrap;
18+
use PHPUnit\Framework\TestCase;
19+
20+
/**
21+
* Verify additional authorization for product operations
22+
*/
23+
class AuthorizationTest extends TestCase
24+
{
25+
/**
26+
* @var ObjectManagerInterface
27+
*/
28+
private $objectManager;
29+
30+
/**
31+
* @var Helper
32+
*/
33+
private $initializationHelper;
34+
35+
/**
36+
* @var HttpRequest
37+
*/
38+
private $request;
39+
40+
/**
41+
* @var ProductRepositoryInterface
42+
*/
43+
private $productRepository;
44+
45+
/**
46+
* @inheridoc
47+
*/
48+
protected function setUp(): void
49+
{
50+
$this->objectManager = Bootstrap::getObjectManager();
51+
$this->initializationHelper = $this->objectManager->get(Helper::class);
52+
$this->productRepository = $this->objectManager->get(ProductRepositoryInterface::class);
53+
$this->request = $this->objectManager->get(HttpRequest::class);
54+
}
55+
56+
/**
57+
* Verify AuthorizedSavingOf
58+
*
59+
* @magentoDataFixture Magento/Catalog/_files/product_simple.php
60+
* @param array $data
61+
*
62+
* @dataProvider postRequestData
63+
*/
64+
public function testAuthorizedSavingOf(array $data): void
65+
{
66+
$this->request->setPost(new Parameters($data));
67+
68+
/** @var Product $product */
69+
$product = $this->productRepository->get('simple');
70+
71+
$product = $this->initializationHelper->initialize($product);
72+
$this->assertEquals('simple_new', $product->getName());
73+
$this->assertEquals(
74+
'container2',
75+
$product->getCustomAttribute('options_container')->getValue()
76+
);
77+
}
78+
79+
/**
80+
* @return array
81+
*/
82+
public function postRequestData(): array
83+
{
84+
return [
85+
[
86+
[
87+
'product' => [
88+
'name' => 'simple_new',
89+
'custom_design' => '',
90+
'page_layout' => '',
91+
'options_container' => 'container2',
92+
'custom_layout_update' => '',
93+
'custom_design_from' => '',
94+
'custom_design_to' => '',
95+
'custom_layout_update_file' => '',
96+
],
97+
'use_default' => [
98+
'custom_design' => '1',
99+
'page_layout' => '1',
100+
'options_container' => '1',
101+
'custom_layout' => '1',
102+
'custom_design_from' => '1',
103+
'custom_design_to' => '1',
104+
'custom_layout_update_file' => '1',
105+
],
106+
]
107+
],
108+
[
109+
[
110+
'product' => [
111+
'name' => 'simple_new',
112+
'page_layout' => '',
113+
'options_container' => 'container2',
114+
'custom_design' => '',
115+
'custom_design_from' => '',
116+
'custom_design_to' => '',
117+
'custom_layout' => '',
118+
'custom_layout_update_file' => '__no_update__',
119+
],
120+
'use_default' => null,
121+
]
122+
],
123+
];
124+
}
125+
126+
/**
127+
* Verify AuthorizedSavingOf when change design attributes
128+
*
129+
* @magentoDataFixture Magento/Catalog/_files/product_simple.php
130+
* @param array $data
131+
*
132+
* @dataProvider postRequestDataException
133+
* @throws AuthorizationException
134+
*/
135+
public function testAuthorizedSavingOfWithException(array $data): void
136+
{
137+
$this->expectException(AuthorizationException::class);
138+
$this->expectErrorMessage('Not allowed to edit the product\'s design attributes');
139+
$this->request->setPost(new Parameters($data));
140+
141+
/** @var Product $product */
142+
$product = $this->productRepository->get('simple');
143+
144+
$this->initializationHelper->initialize($product);
145+
}
146+
147+
/**
148+
* @return array
149+
*/
150+
public function postRequestDataException(): array
151+
{
152+
return [
153+
[
154+
[
155+
'product' => [
156+
'name' => 'simple_new',
157+
'page_layout' => '1column',
158+
'options_container' => 'container2',
159+
'custom_design' => '',
160+
'custom_design_from' => '',
161+
'custom_design_to' => '',
162+
'custom_layout' => '',
163+
'custom_layout_update_file' => '__no_update__',
164+
],
165+
'use_default' => null,
166+
],
167+
],
168+
];
169+
}
170+
}

0 commit comments

Comments
 (0)