Issue
- The user who doesn't have the permission of 'Manage Order' is still able to update the order from an "Open" status to a "Quote Requested" status.
-
Steps to reproduce:
1. Create a 'Minium' site.
2. Navigate to the 'Minium's Catalog page and add some products to the cart.
3. After that, navigate to the Control Panel> Users> Roles> Create a new 'Regular Role' (Test Order Role).
4. Once the role is created, navigate to Define Permissions> Commerce> Order Management> Order and tick the below check box:
5. Navigate again to Define Permissions> Commerce> Store Management> Channels and tick the below check box:
6. Navigate to the Control Panel> Users> Users and Organizations>Create a new user (Test User1) and assign the role that was created in step 3, and also provide the membership of the site Liferay DXP.
7. Log in with the 'Test User1' user, navigate to Application Menu> Order Management> Orders> and click on any open order.
8. Then click on the ‘Quote Requested’ button and the user is able to request the quote.
- Observed Behavior: The 'Quote Requested' button in Commerce Orders is available to roles that do not have the "Manage Order" permissions assigned.
- Expected Behavior: The 'Quote Requested' button in Commerce Orders should not be available to roles that do not have the "Manage Order" permissions.
Environment
- Commerce 4.0
Resolution
- The observed behavior is a known issue that has already been addressed in DXP 2025.Q1.0.
- To achieve the expected outcome, the user needs to upgrade their environment to at least DXP 2025.Q1.0.