Request for modification in groupfilterconsumer plugin

  • Posts: 128
  • Thank you received: 2
7 years 10 months ago #259523

-- HikaShop version -- : 2.6.4
-- HikaSerial version -- : 1.10.4
-- Joomla version -- : 3.6.5
-- PHP version -- : 5.6

Hi there,

It is great that we can control what user groups can consume certain serials with the groupfilterconsumer plugin, but I feel it is missing an error message in case the user is not authorized to consume the serial. I feel we need to show the reason why there is a problem when the serial consumption does not work due to this plugin.

I propose the following change in groupfilterconsumer.php

Replace this (line 73)

	if(!$f)
				$do = false;

By this
if(!$f){
				$do = false;
				$app = JFactory::getApplication();
				$app->enqueueMessage(JText::_('HIKASERIAL_NOT_AUTHORISED'), 'error');
			}


Would this be possible please?

Many thanks!

Please Log in or Create an account to join the conversation.

  • Posts: 26156
  • Thank you received: 4028
  • MODERATOR
7 years 10 months ago #259528

Hi,

I understand your request but in the other hand, I didn't add that message for a very specific reason : security.
Displaying a message to indicate the reason why the consumption is not made can give indications to the end user for some elements which he shouldn't know.
That's why a user won't know if a serial exist or not, he won't know that the serial is entered is assigned to someone else, that he does not have the right to perform the action, etc. It is security purposes !

I can see to add an option in the plugin instance configuration. So when you add a group filter, you could authorize the display of a message.
But I won't add that kind of message by default for everybody.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 128
  • Thank you received: 2
7 years 10 months ago #259553

I see your point, somebody could try to guess valid serials by looking at the error message provided when trying to consume it.

OK, let's leave it as it is, thanks!

Please Log in or Create an account to join the conversation.

Moderators: Obsidev
Time to create page: 0.058 seconds
Powered by Kunena Forum