Skip to content

Commit f630b4e

Browse files
serhii-balkoserhii-balko
committed
Merge remote-tracking branch 'origin/MC-33765' into 2.4-develop-pr29
2 parents 1911d58 + 418e80b commit f630b4e

File tree

6 files changed

+195
-12
lines changed

6 files changed

+195
-12
lines changed

‎app/code/Magento/ConfigurableProduct/Block/DataProviders/PermissionsData.php

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\ConfigurableProduct\Block\DataProviders;
9+
10+
use Magento\Framework\AuthorizationInterface;
11+
use Magento\Framework\View\Element\Block\ArgumentInterface;
12+
13+
/**
14+
* Provides permissions data into template.
15+
*/
16+
class PermissionsData implements ArgumentInterface
17+
{
18+
/**
19+
* @var AuthorizationInterface
20+
*/
21+
private $authorization;
22+
23+
/**
24+
* Constructor
25+
*
26+
* @param AuthorizationInterface $authorization
27+
*/
28+
public function __construct(AuthorizationInterface $authorization)
29+
{
30+
$this->authorization = $authorization;
31+
}
32+
33+
/**
34+
* Check that user is allowed to manage attributes
35+
*
36+
* @return bool
37+
*/
38+
public function isAllowedToManageAttributes(): bool
39+
{
40+
return $this->authorization->isAllowed('Magento_Catalog::attributes_attributes');
41+
}
42+
}

‎app/code/Magento/ConfigurableProduct/view/adminhtml/layout/catalog_product_wizard.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848
<item name="modal" xsi:type="string">configurableModal</item>
4949
<item name="dataScope" xsi:type="string">productFormConfigurable</item>
5050
</argument>
51+
<argument name="permissions" xsi:type="object">Magento\ConfigurableProduct\Block\DataProviders\PermissionsData</argument>
5152
</arguments>
5253
</block>
5354
<block class="Magento\ConfigurableProduct\Block\Adminhtml\Product\Steps\Bulk" name="step3" template="Magento_ConfigurableProduct::catalog/product/edit/attribute/steps/bulk.phtml">

‎app/code/Magento/ConfigurableProduct/view/adminhtml/templates/catalog/product/edit/attribute/steps/attributes_values.phtml

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,18 @@
55
*/
66

77
/* @var $block \Magento\ConfigurableProduct\Block\Adminhtml\Product\Steps\AttributeValues */
8+
$isAllowedToManageAttributes = $block->getPermissions()->isAllowedToManageAttributes();
9+
$attributesUrl = $block->getUrl('catalog/product_attribute/getAttributes');
10+
$optionsUrl = $block->getUrl('catalog/product_attribute/createOptions');
811
?>
912
<div data-bind="scope: '<?= /* @noEscape */ $block->getComponentName() ?>'">
1013
<h2 class="steps-wizard-title"><?= $block->escapeHtml(
1114
__('Step 2: Attribute Values')
1215
); ?></h2>
1316
<div class="steps-wizard-info">
1417
<span><?= $block->escapeHtml(
15-
__('Select values from each attribute to include in this product. Each unique combination of values creates a unique product SKU.')
18+
__('Select values from each attribute to include in this product. ' .
19+
'Each unique combination of values creates a unique product SKU.')
1620
);?></span>
1721
</div>
1822
<div data-bind="foreach: attributes, sortableList: attributes">
@@ -72,7 +76,8 @@
7276
<label data-bind="text: label, visible: label, attr:{for:id}"
7377
class="admin__field-label"></label>
7478
</div>
75-
<div class="admin__field admin__field-create-new" data-bind="attr:{'data-role':id}, visible: !label">
79+
<div class="admin__field admin__field-create-new"
80+
data-bind="attr:{'data-role':id}, visible: !label">
7681
<div class="admin__field-control">
7782
<input class="admin__control-text"
7883
name="label"
@@ -101,14 +106,14 @@
101106
</li>
102107
</ul>
103108
</fieldset>
104-
<button class="action-create-new action-tertiary"
105-
type="button"
106-
data-action="addOption"
107-
data-bind="click: $parent.createOption, visible: canCreateOption">
108-
<span><?= $block->escapeHtml(
109-
__('Create New Value')
110-
); ?></span>
111-
</button>
109+
<?php if ($isAllowedToManageAttributes): ?>
110+
<button class="action-create-new action-tertiary"
111+
type="button"
112+
data-action="addOption"
113+
data-bind="click: $parent.createOption, visible: canCreateOption">
114+
<span><?= $block->escapeHtml(__('Create New Value')); ?></span>
115+
</button>
116+
<?php endif; ?>
112117
</div>
113118
</div>
114119
</div>
@@ -120,8 +125,8 @@
120125
"<?= /* @noEscape */ $block->getComponentName() ?>": {
121126
"component": "Magento_ConfigurableProduct/js/variations/steps/attributes_values",
122127
"appendTo": "<?= /* @noEscape */ $block->getParentComponentName() ?>",
123-
"optionsUrl": "<?= /* @noEscape */ $block->getUrl('catalog/product_attribute/getAttributes') ?>",
124-
"createOptionsUrl": "<?= /* @noEscape */ $block->getUrl('catalog/product_attribute/createOptions') ?>"
128+
"optionsUrl": "<?= /* @noEscape */ $attributesUrl ?>",
129+
"createOptionsUrl": "<?= /* @noEscape */ $optionsUrl ?>"
125130
}
126131
}
127132
}

‎dev/tests/integration/testsuite/Magento/ConfigurableProduct/Block/Adminhtml/Product/Steps/AttributeValuesTest.php

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\ConfigurableProduct\Block\Adminhtml\Product\Steps;
9+
10+
use Magento\Backend\Model\Auth\Session;
11+
use Magento\ConfigurableProduct\Block\DataProviders\PermissionsData;
12+
use Magento\Framework\View\Layout;
13+
use Magento\Framework\View\LayoutInterface;
14+
use Magento\TestFramework\Helper\Bootstrap;
15+
use Magento\User\Model\User;
16+
use PHPUnit\Framework\TestCase;
17+
18+
/**
19+
* @magentoAppArea adminhtml
20+
* @magentoAppIsolation enabled
21+
* @magentoDbIsolation enabled
22+
*/
23+
class AttributeValuesTest extends TestCase
24+
{
25+
/**
26+
* @magentoDataFixture Magento/ConfigurableProduct/_files/restricted_admin_with_catalog_permissions.php
27+
*/
28+
public function testRestrictedUserNotAllowedToManageAttributes()
29+
{
30+
$user = Bootstrap::getObjectManager()->create(
31+
User::class
32+
)->loadByUsername(
33+
'admincatalog_user'
34+
);
35+
36+
/** @var $session Session */
37+
$session = Bootstrap::getObjectManager()->get(
38+
Session::class
39+
);
40+
$session->setUser($user);
41+
42+
/** @var $layout Layout */
43+
$layout = Bootstrap::getObjectManager()->get(
44+
LayoutInterface::class
45+
);
46+
47+
/** @var \Magento\ConfigurableProduct\Block\Adminhtml\Product\Steps\AttributeValues */
48+
$block = $layout->createBlock(
49+
AttributeValues::class,
50+
'step2',
51+
[
52+
'data' => [
53+
'config' => [
54+
'form' => 'product_form.product_form',
55+
'modal' => 'configurableModal',
56+
'dataScope' => 'productFormConfigurable',
57+
],
58+
'permissions' => Bootstrap::getObjectManager()->get(PermissionsData::class)
59+
]
60+
]
61+
);
62+
$isAllowedToManageAttributes = $block->getPermissions()->isAllowedToManageAttributes();
63+
$html = $block->toHtml();
64+
$this->assertFalse($isAllowedToManageAttributes);
65+
$this->assertStringNotContainsString('<button class="action-create-new action-tertiary"', $html);
66+
}
67+
}

‎dev/tests/integration/testsuite/Magento/ConfigurableProduct/_files/restricted_admin_with_catalog_permissions.php

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
use Magento\Authorization\Model\Acl\Role\Group;
9+
use Magento\Authorization\Model\RoleFactory;
10+
use Magento\Authorization\Model\Role;
11+
use Magento\Authorization\Model\Rules;
12+
use Magento\Authorization\Model\UserContextInterface;
13+
use Magento\TestFramework\Helper\Bootstrap;
14+
use Magento\User\Model\User;
15+
16+
/** @var Role $role */
17+
$role = Bootstrap::getObjectManager()->get(RoleFactory::class)->create();
18+
$role->setName('role_catalog_permissions');
19+
$role->setData('role_name', $role->getName());
20+
$role->setRoleType(Group::ROLE_TYPE);
21+
$role->setUserType((string)UserContextInterface::USER_TYPE_ADMIN);
22+
$role->save();
23+
24+
/** @var $rule Rules */
25+
$rule = Bootstrap::getObjectManager()->create(Rules::class);
26+
$rule->setRoleId($role->getId())->setResources(['Magento_Catalog::catalog'])->saveRel();
27+
28+
/** @var User $user */
29+
$user = Bootstrap::getObjectManager()->create(User::class);
30+
$user->setData(
31+
[
32+
'firstname' => 'firstname',
33+
'lastname' => 'lastname',
34+
'email' => 'admincatalog@example.com',
35+
'username' => 'admincatalog_user',
36+
'password' => 'admincatalog_password1',
37+
'is_active' => 1,
38+
]
39+
);
40+
$user->setRoleId($role->getId())->save();

‎dev/tests/integration/testsuite/Magento/ConfigurableProduct/_files/restricted_admin_with_catalog_permissions_rollback.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
use Magento\Authorization\Model\Role;
9+
use Magento\Authorization\Model\RoleFactory;
10+
use Magento\Authorization\Model\Rules;
11+
use Magento\Authorization\Model\RulesFactory;
12+
use Magento\TestFramework\Helper\Bootstrap;
13+
use Magento\User\Model\User;
14+
15+
// Deleting the user and the role.
16+
/** @var User $user */
17+
$user = Bootstrap::getObjectManager()->create(User::class);
18+
$user->loadByUsername('admincatalog_user')->delete();
19+
/** @var Role $role */
20+
$role = Bootstrap::getObjectManager()->get(RoleFactory::class)->create();
21+
$role->load('role_catalog_permissions', 'role_name');
22+
if ($role->getId()) {
23+
/** @var Rules $rules */
24+
$rules = Bootstrap::getObjectManager()->get(RulesFactory::class)->create();
25+
$rules->load($role->getId(), 'role_id');
26+
$rules->delete();
27+
$role->delete();
28+
}

0 commit comments

Comments
 (0)