• Resolved Hamed Momeni

    (@2hamed)


    I’m trying to get a list of products and categories to display in an Android application.
    I’m using WooCommerce REST API along with JWT Authentication. The problem here after I’ve authenticated with a user who has customer role, I am unable to list any of the products or categories. This is the response that I get:

    {
    “code”: “woocommerce_rest_cannot_view”,
    “message”: “Sorry, you can not list resources.”,
    “data”: {
    “status”: 403
    }
    }

    I am positive it’s due to the user permissions since I can list categories when I switch the user role to that of any management role.

    I’ve even used Capability Manager Enhanced to grant the needed permissions (even manage woocommerce) to the customer role to no success.

    • This topic was modified 8 years, 1 month ago by Hamed Momeni.
Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support RK a11n

    (@riaanknoetze)

    Compare the capabilities for customer with that of shop_manager in the code: https://github.com/woocommerce/woocommerce/blob/7b95988811a988053ae0c7e031ee75a3a838dff0/includes/class-wc-install.php#L653-L699

    You’d need more than just manage_woocommerce methinks; Likely ‘manage_categories`.

    Thread Starter Hamed Momeni

    (@2hamed)

    Ok, I manged to achieve it by granting specific access to products, product_categories, etc. to the customer role.
    But I don’t know why do I even need to do this? Shouldn’t listing products and their categories be publicly available to anyone? Even those unregistered?
    Or should not a Customer be able to view/manage his/her own order?

    I am also facing the same issue help me out

    • This reply was modified 7 years, 8 months ago by vandan19.

    This issue should not be resolved. In fact, this issue makes developing apps with woocommerce highly problematic unless they are used only by shop_managers.

    Listing items should be open for items like products for example. That have different behaviour than default rest API and default rest API endpoint doesn’t pass enough attributes to make use of it. Also, default endpoint seam to have wrong endpoint slug (product instead of products).

    Surprisingly woocommerce on read checks if user can read_private_posts instead of just read. This can be fixed with below check, however, I am not sure what implication it have on security.

    
    add_filter( 'woocommerce_rest_check_permissions',
    	function ( $permission, $context, $object_id, $post_type ) {
    		if ( $context !== 'read' ) {
    			return $permission;
    		}
    
    		$post_type_object = get_post_type_object( $post_type );
    
    		return current_user_can( $post_type_object->cap->read, $object_id );
    	}, 10, 4 );
    
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Unable to list products or categories in WooCommerce Rest API’ is closed to new replies.