Bug Report & Fix (Vendor Plugin)

  • Hi Guys,

    I reported this bug to you a while ago via email and it’s still not resolved.

    The vendor plugin doesn’t play nicely when a user has access to wp-admin to edit a custom post type.

    The bug:

    – When a vendor with “limited access” edits/adds a custom post type it throws the error: “You do not have permission to edit this product.”, even though they have been granted permission to edit this custom post type.

    The code causing the issue can be found below. The problem is that it’s not checking against the post type so it throws this error for all post types, even though they’re not products.

    File: class.yith-vendors-admin.php
    Function: disabled_manage_other_vendors_posts()
    Code:

    if ( $vendor->has_limited_access() && false !== $product_vendor && $vendor->id != $product_vendor->id) {
     wp_die( sprintf( __( 'You do not have permission to edit this product. %1$sClick here to view and edit your products%2$s.', 'yith_wc_product_vendors' ), '<a href="' . esc_url( 'edit.php?post_type=product' ) . '">', '</a>' ) );
}

    The fix:

    Simply add && $post->post_type == “product” to the if statement, as follows so that it only fires when a user is trying to edi a product:

    if ( $vendor->has_limited_access() && false !== $product_vendor && $vendor->id != $product_vendor->id && $post->post_type == "product") {
      wp_die( sprintf( __( 'You do not have permission to edit this product. %1$sClick here to view and edit your products%2$s.', 'yith_wc_product_vendors' ), '<a href="' . esc_url( 'edit.php?post_type=product' ) . '">', '</a>' ) );
}

    If you could add this in your next release that would be brilliant as currently I’m having to edit the plugin code each time you release a new version, which isn’t a long term solution.

    https://www.ads-software.com/plugins/yith-essential-kit-for-woocommerce-1/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author YITHEMES

    (@yithemes)

    Hi Scotty,

    that is not the right way to do it,
    you can allow post type permission to a vendor using a filter as explained here :

    https://support.yithemes.com/hc/en-us/articles/218491117-Allow-Vendor-to-edit-posts-and-pages

    best regards

    YIThemes

    Thread Starter Scott Bowler

    (@scottybowl2)

    I disagree – by default Yith shouldn’t interrupt the accessibility of other post types, that’s not the scope of the plugin.

    I handle permission to post types separately (and globally) and having to manage this twice just for the vendor plugin is a huge headache.

    Plugin Author YITHEMES

    (@yithemes)

    Dear Scotty,

    we are sorry for your experience, anyway we hide post types to the vendors for security reasons and the plugin allow you to enable the post types you want.

    best regards

    YITHemes

    Thread Starter Scott Bowler

    (@scottybowl2)

    Just looked into implementing this using the code in your link and it seems the “yith_wpv_vendors_allowed_post_types” filter doesn’t exist in the Yith source code.

    In addition, Yith doesn’t attempt to check what post types the user is allowed to have access to – the code below (from Yith) just throws an error if the user isn’t an admin, super user, vendor or the owner of the product when trying to access other post types:

    if ( $vendor->has_limited_access() && false !== $product_vendor && $vendor->id != $product_vendor->id ) {
                wp_die( sprintf( __( 'You do not have permission to edit this product. %1$sClick here to view and edit your products%2$s.', 'yith_wc_product_vendors' ), '<a href="' . esc_url( 'edit.php?post_type=product' ) . '">', '</a>' ) );
            }

    Perhaps this functionality has been removed at some point?

    Plugin Author YITHEMES

    (@yithemes)

    Dear Scotty,

    as we told you before we hide post types to the vendors for security reasons, this point it’ s must important for us and we don’ t plan to change this in future.

    best regards

    YITHemes

    Thread Starter Scott Bowler

    (@scottybowl2)

    Hi Guys,

    I think you might have misread my most recent post ?? The solution you provided doesn’t work because the filter you suggested no longer exists in your codebase.

    Sorry to keep going on about this point, but it’s a big issue.

    Thanks in advance,

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Bug Report & Fix (Vendor Plugin)’ is closed to new replies.