fix: Download ticket and invoice made available to ticket purchaser only #5806
Conversation
|
This pull request is being automatically deployed with Vercel (learn more). 🔍 Inspect: https://vercel.com/eventyay/open-event-frontend/8z4iykymc |
codedsun
force-pushed
the
permissions
branch
from
0c6cdcb to
154d4a6
Compare
|
|
Codecov Report
@@ Coverage Diff @@
## development #5806 +/- ##
===============================================
+ Coverage 23.45% 23.47% +0.02%
===============================================
Files 512 512
Lines 5445 5456 +11
Branches 63 63
===============================================
+ Hits 1277 1281 +4
- Misses 4152 4159 +7
Partials 16 16
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
Thanks, but this is a bit confusing for the user. First the user sees a button. Then the user clicks on the button. Then the use gets the info - "The information is not available". In that case if the user has not bought the tickets, the button should not be there at all.
Therefore please change this as follows:
- Show the download link of the user ticket (only for that user) in the user area
- For users who have not bought the ticket (just received it from someone else), do not show "All Tickets" and "Invoice" button.
app/controllers/orders/view.js
Outdated
| @@ -13,6 +13,10 @@ export default class ViewController extends Controller { | |||
|
|
|||
| @action | |||
| downloadInvoice(eventName, orderId) { | |||
| if (this.model.order.user.get('id') !== this.authManager.currentUser.id) { | |||
| confirm('Only the account that made the order is able to access this invoice.'); | |||
There was a problem hiding this comment.
This is browser confirm, not our dialog
app/controllers/orders/view.js
Outdated
| @@ -44,6 +48,10 @@ export default class ViewController extends Controller { | |||
| } | |||
|
|
|||
| downloadTickets(eventName, orderId) { | |||
| if (this.model.order.user.get('id') !== this.authManager.currentUser.id) { | |||
There was a problem hiding this comment.
This should download the attendee tickets instead
codedsun
force-pushed
the
permissions
branch
from
154d4a6 to
b8859ef
Compare
|
order.user should not be available to the ticket holder Please open a server issue for this |
|
|
Fixes #5623
Fixes fossasia/open-event-server#7397
Short description of what this resolves:
Changes proposed in this pull request:
Checklist
developmentbranch.