What's New
Bug Fixes
- fix(admin): authorize slide-over write actions and require livewire-slide-overs 2.1.1 (#692)
The slide-over panel forwarded every argument sent by the browser to the opened component, so lazy or defer could skip mount() and the permission check it holds. laravelcm/livewire-slide-overs 2.1.1 only forwards the arguments a component declares (public properties and mount() parameters), which fixes GHSA-hg7g-pvvc-mggp, and Shopper now requires ^2.1.1. The write actions no longer rely on mount() running: AddProduct::store() checks add_products, AddCollectionForm::store() checks add_collections, the add bulk action of CollectionProductsList checks edit_collections and the add header action of AttributeValues checks edit_attributes.
- fix(admin): authorize the category tree, record forms, variant writes and dashboard widgets (#695)
ReOrderCategories rendered the category tree without any check, so a guest who reached the slide-over got the whole tree back. It now requires edit_categories in mount(), and the reorder action of the category index checks the same permission.
BrandForm, CategoryForm, SupplierForm and AttributeForm accepted either add or edit when they opened, so a role allowed to create could open any existing record. They now require edit_<resource> for an existing record and add_<resource> for a new one.
GenerateVariants checks delete_product_variants before removing variants and add_product_variants before adding new ones, and SaveProductVariantsAction looks each variant up through its product, so an id from another product fails. Variant stock and price changes (Variant, Pricing, ManagePricing) require edit_product_variants instead of edit_products.
The customers selected on a discount are loaded through the customers scope, so a staff account id sent by the browser returns nothing. The SidebarComponent properties are locked, so the browser can no longer change the sidebar class or view.
access_dashboard grants access to the back office, not to sales data. The revenue chart, top selling products and recent orders widgets now require browse_orders, and each stat card shows only when the user can browse its resource (orders, products, customers).
Upgrading
composer update "shopper/*" -W-W lets Composer move laravelcm/livewire-slide-overs from 2.1.0 to 2.1.1 in your lock file.
A custom role now needs:
edit_categoriesto reorder categories.edit_<resource>to open an existing brand, category, supplier or attribute, andadd_<resource>to create one.edit_product_variantsto change a variant's stock or prices.add_product_variantsanddelete_product_variantswhen generating variants adds or removes some.browse_ordersto see the revenue chart, top selling products, recent orders and the revenue and orders cards on the dashboard. The products and customers cards needbrowse_productsandbrowse_customers.
The administrator role already has every permission.
Contributors
Full Changelog: v2.12.1...v2.12.2