{"action":"created","issue":{"url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/4732","repository_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads","labels_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/4732/labels{/name}","comments_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/4732/comments","events_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/4732/events","html_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/pull/4732","id":162720190,"number":4732,"title":"EDD employee user_role must not be able to delete payments","user":{"login":"rene-hermenau","id":878194,"avatar_url":"https://avatars.githubusercontent.com/u/878194?v=3","gravatar_id":"","url":"https://api.github.com/users/rene-hermenau","html_url":"https://github.com/rene-hermenau","followers_url":"https://api.github.com/users/rene-hermenau/followers","following_url":"https://api.github.com/users/rene-hermenau/following{/other_user}","gists_url":"https://api.github.com/users/rene-hermenau/gists{/gist_id}","starred_url":"https://api.github.com/users/rene-hermenau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rene-hermenau/subscriptions","organizations_url":"https://api.github.com/users/rene-hermenau/orgs","repos_url":"https://api.github.com/users/rene-hermenau/repos","events_url":"https://api.github.com/users/rene-hermenau/events{/privacy}","received_events_url":"https://api.github.com/users/rene-hermenau/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-06-28T15:48:51Z","updated_at":"2016-06-28T18:20:35Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/pulls/4732","html_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/pull/4732","diff_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/pull/4732.diff","patch_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/pull/4732.patch"},"body":"user_roles _shop_accountant_, _shop_worker_ and _shop_vendor_ are all able to delete payments! \r\nEmployees should never be able to delete anything, especially not a important thing like a payment transaction.\r\n\r\nQuick fix would be to change the deletion capability to `delete_posts`.\r\n\r\nThis is the minimum capability a user should be able to delete any payment and this would include all above mentioned user_roles. \r\n\r\nIf a store owner needs a user_role with deleting capabilities he still can select the shop_manager or would be able than to create a custom user_role with a third party plugin. \r\nThis is not possible at the moment, so all EDD default users are able to delete payments.\r\n\r\nCan we change that urgently?"},"comment":{"url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/comments/229136954","html_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/pull/4732#issuecomment-229136954","issue_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/4732","id":229136954,"user":{"login":"chriscct7","id":1324637,"avatar_url":"https://avatars.githubusercontent.com/u/1324637?v=3","gravatar_id":"","url":"https://api.github.com/users/chriscct7","html_url":"https://github.com/chriscct7","followers_url":"https://api.github.com/users/chriscct7/followers","following_url":"https://api.github.com/users/chriscct7/following{/other_user}","gists_url":"https://api.github.com/users/chriscct7/gists{/gist_id}","starred_url":"https://api.github.com/users/chriscct7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chriscct7/subscriptions","organizations_url":"https://api.github.com/users/chriscct7/orgs","repos_url":"https://api.github.com/users/chriscct7/repos","events_url":"https://api.github.com/users/chriscct7/events{/privacy}","received_events_url":"https://api.github.com/users/chriscct7/received_events","type":"User","site_admin":false},"created_at":"2016-06-28T18:20:35Z","updated_at":"2016-06-28T18:20:35Z","body":"It is intended that shop_accountants and shop_managers should have the ability to delete payments, as defined by the definition of their roles in their ability to fully manage payments (which by definition includes the right to delete them). These roles are not equivalent to each other, as the former does not have access to certain parts of EDD (for example settings) but does have the ability to see certain things (for example edd_sensitive_data) that a shop worker cannot.\r\n\r\nIt could be argued shop workers should not have the right to delete payments, but given they've had this permission for 3 years now, its not something that should probably not be removed. If we remove it, we'd have to deal with the repercussions of this breaking a long time used workflow for countless online stores, and so far, this is the only registered complaint we've received about this functionality, despite the large number of active installs who have had it for many years now.\r\n\r\nThe shop vendor role, at least in testing it, does not have the ability that I could find to delete payments.\r\n\r\nIf anything, we should add `delete_shop_payments` to the shop accountants make this permission more explicit. We could move to using that over `edit_shop_payments` for the deletion, but that would be something we'd have to do either over time BC-breaking or meta_cap mapping for a BC option.\r\n\r\nIt should be noted the shop_manager account already has `delete_shop_payment`."}}
{"actor":{"display_login":"chriscct7"}}