search

klaviyo / magento2-klaviyo

37 stars 51 forks source link

ACL is missing #160

Closed mortenbirkelund closed 6 months ago

mortenbirkelund commented 2 years ago

The module is missing ACL, meaning that only admin users with full access is able to see the module.

mortenbirkelund commented 2 years ago

https://devdocs.magento.com/guides/v2.4/ext-best-practices/tutorials/create-access-control-list-rule.html

klaviyojad commented 2 years ago

@mortenbirkelund thank you for bringing this to our attention. This has been brought up here and is currently in our backlog

mortenbirkelund commented 2 years ago

Thanks. Do you think this will ever get fixed?

klaviyojad commented 2 years ago

@mortenbirkelund like I said, its in our backlog. Its not really a blocker for many customers just a nice to have.

kasperth commented 2 years ago

@klaviyojad possible to get status on this?

JamesFX2 commented 1 year ago

oh ffs

JamesFX2 commented 1 year ago 
<?xml version="1.0" ?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <resource id="Magento_Backend::stores">
                    <resource id="Magento_Backend::stores_settings">
                        <resource id="Magento_Config::config">
                            <resource id="Klaviyo_Reclaim::klaviyo_reclaim_general" title="Klaviyo Configuration" translate="title" sortOrder="150" />
                        </resource>
                    </resource>
                </resource>
            </resource>
        </resources>
    </acl>
</config>
snoop0x7b commented 9 months ago

@mortenbirkelund like I said, its in our backlog. Its not really a blocker for many customers just a nice to have.

PCI does require that you give people the least possible level of permissions to do their job. https://pcidssguide.com/pci-dss-requirement-7/

cykolln commented 6 months ago

Thanks for the contribution @snoop0x7b! This has been merged and is available in the latest release