shopperlabs/shopper v3.0.0-rc.7 on GitHub

Important

This is the seventh release candidate of Shopper 3.0. It is a security release: it requires laravelcm/livewire-slide-overs 2.1.1, which fixes GHSA-hg7g-pvvc-mggp, and closes authorization gaps in the admin slide-overs. Upgrade from any earlier 3.0 release candidate.

Installation

"minimum-stability": "RC",
"prefer-stable": true

composer require shopper/framework:^3.0.0-rc

Bug Fixes

fix(admin): authorize slide-over write actions and require livewire-slide-overs 2.1.1 (#691)

The slide-over panel forwarded every argument sent by the browser to the opened component, so lazy or defer could skip mount() and the permission check it holds. laravelcm/livewire-slide-overs 2.1.1 only forwards the arguments a component declares (public properties and mount() parameters), and Shopper now requires ^2.1.1. The write actions no longer rely on mount() running: AddProduct::store() and ImportCsv::store() check products.create, AddCollectionForm::store() checks collections.create, and the add bulk action of CollectionProductsList checks collections.edit.

fix(admin): require browse permissions on the product and customer pickers (#693)

ProductsPicker and CustomersPicker only checked the ability argument sent when the panel opens. It comes from the browser and is optional, so leaving it out, or passing a permission the user already held, listed the catalog or the customers (names and emails). They now always authorize products.browse and customers.browse in mount(), then the caller's ability when one is given. The add header action of AttributeValues now checks attributes.edit, like its edit and delete actions.

Upgrading

composer update "shopper/*" -W

-W lets Composer move laravelcm/livewire-slide-overs from 2.1.0 to 2.1.1 in your lock file.

A custom role now needs products.browse to open the product picker (related products, discounts, price lists, media hotspots) and customers.browse to open the customer picker (discounts, customer groups). The administrator role already has every permission.

@shopperlabs/shopper-types 3.0.0-rc.7 is published under the beta tag. The SDK has no change in this release and stays at 1.0.0-rc.3.

Contributors

@mckenziearts

Full Changelog: v3.0.0-rc.6...v3.0.0-rc.7