Automattic / Automattic/jetpack-crm
Quote Templates list view asks for a different capability than the page
- Dominant language
- PHP
- Stars
- 13
- Forks
- 8
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 13
Description
The Quote Templates admin page registers with `admin_zerobs_quotes`, the edit capability. The list view behind it is gated on `admin_zerobs_view_quotes`, the view one.
`ZeroBSCRM.Core.Menus.WP.php:164` and `:566`:
```php
'perms' => 'admin_zerobs_quotes',
```
`jpcrm_perms_view_list_type()` in `ZeroBSCRM.Permissions.php`:
```php
case 'quote':
case 'quotetemplate':
return zeroBSCRM_permsViewQuotes();
```
One shipped role holds one and not the other. Mail Manager (`zerobs_mailmgr`) is granted `admin_zerobs_view_quotes` at `ZeroBSCRM.Permissions.php:371` and never `admin_zerobs_quotes` — its edit grants are contacts, contact tags and tasks. So a Mail Manager cannot open Quote Templates, and the menu item does not appear for them, but a POST to `admin-ajax.php` with `v[listtype]=quotetemplate` returns the list. No other role is affected: Jetpack CRM Admin, administrator, Contact Manager and Quote Manager all grant both, and Invoice Manager and Transaction Manager grant neither.
This is not new. The check has been `zeroBSCRM_permsViewQuotes()` for as long as the per-type checks have existed, and #29 carried it over unchanged rather than tightening it as a drive-by.
Deciding which one is right is the actual work here, and it is worth doing for the pair rather than for this one case:
- If viewing quote templates is a view-level thing, the page is too strict and should register with `admin_zerobs_view_quotes`.
- If it is an edit-level thing — a template is a thing you write, not a record you read — the list view is too loose and should use `zeroBSCRM_permsQuotes()`.
The second reads truer to me, but it is the narrowing change, so it wants a look at whether anyone relies on the current behaviour.
`segment` has the same shape of mismatch — gated on `admin_zerobs_view_customers` while its page registers with `admin_zerobs_customers` — but no shipped role separates that pair, so nothing follows from it today. Worth settling at the same time so the two land consistently.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in ZeroBSCRM.Core.Menus.WP.php at lines 164 and 566, then trace jpcrm_perms_view_list_type() and the permission grants around line 371 in ZeroBSCRM.Permissions.php. Compare the Quote Templates and segment page gates with their list-view checks and review shipped-role behavior. Done means the chosen capability model is applied consistently without allowing a role to access a list it cannot access through the page.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100