Automattic / Automattic/jetpack-crm

Quote Templates list view asks for a different capability than the page

Open
#35 0 comments 0 reactions 0 assignees View on GitHub
needs-triage
Dominant language
PHP
Stars
13
Forks
8
Avg merge
1d 10h
Merged PRs (30d)
13

Description

The Quote Templates admin page registers with `admin_zerobs_quotes`, the edit capability. The list view behind it is gated on `admin_zerobs_view_quotes`, the view one.

`ZeroBSCRM.Core.Menus.WP.php:164` and `:566`:

```php
'perms' => 'admin_zerobs_quotes',
```

`jpcrm_perms_view_list_type()` in `ZeroBSCRM.Permissions.php`:

```php
case 'quote':
case 'quotetemplate':
return zeroBSCRM_permsViewQuotes();
```

One shipped role holds one and not the other. Mail Manager (`zerobs_mailmgr`) is granted `admin_zerobs_view_quotes` at `ZeroBSCRM.Permissions.php:371` and never `admin_zerobs_quotes` — its edit grants are contacts, contact tags and tasks. So a Mail Manager cannot open Quote Templates, and the menu item does not appear for them, but a POST to `admin-ajax.php` with `v[listtype]=quotetemplate` returns the list. No other role is affected: Jetpack CRM Admin, administrator, Contact Manager and Quote Manager all grant both, and Invoice Manager and Transaction Manager grant neither.

This is not new. The check has been `zeroBSCRM_permsViewQuotes()` for as long as the per-type checks have existed, and #29 carried it over unchanged rather than tightening it as a drive-by.

Deciding which one is right is the actual work here, and it is worth doing for the pair rather than for this one case:

- If viewing quote templates is a view-level thing, the page is too strict and should register with `admin_zerobs_view_quotes`.
- If it is an edit-level thing — a template is a thing you write, not a record you read — the list view is too loose and should use `zeroBSCRM_permsQuotes()`.

The second reads truer to me, but it is the narrowing change, so it wants a look at whether anyone relies on the current behaviour.

`segment` has the same shape of mismatch — gated on `admin_zerobs_view_customers` while its page registers with `admin_zerobs_customers` — but no shipped role separates that pair, so nothing follows from it today. Worth settling at the same time so the two land consistently.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in ZeroBSCRM.Core.Menus.WP.php at lines 164 and 566, then trace jpcrm_perms_view_list_type() and the permission grants around line 371 in ZeroBSCRM.Permissions.php. Compare the Quote Templates and segment page gates with their list-view checks and review shipped-role behavior. Done means the chosen capability model is applied consistently without allowing a role to access a list it cannot access through the page.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.