Prestashop: Can delete my own profile

[marionf]

Reminder

DO NOT disclose security issues here, contact [email protected] instead!

Describe the bug
You can delete your own profile

To Reproduce
Steps to reproduce the behavior:

1. Go to Advanced parameters > Team > Profile
2. Create a new profile "Admin"
3. Go to Advanced parameters > Team > Permissions > Admin
4. Give it all permissions
5. Go to Advanced parameters > Team > Employees
6. Create a new employee with the Admin profile
7. Log out of BO
8. Log in with the created admin employee
9. Go to Advanced parameters > Team > Profile
10. Delete the Admin profile
11. You have access to nothing

Additionnal information
PrestaShop version: 1.7.4.2
PHP version: N/A

[sarjon]

@marionf this makes sense, but if I delete other Profile (not my own) that other employees are assigned to, should I be able to do it? I guess it could have unexpected results as well, but I didn't test it. What do you think?

[marionf]

@sarjon If you delete an employee account of someone else, if this person was logged in the BO he/she is disconnected. It seems to me correct behavior, wdyt ?

[sarjon]

Yes @marionf, but my question is about Profile (not Employee). If you delete someone else's Profile.

For example, there is Employee named Tom with Salesman profile. Then I delete Salesman profile. This is what happens to Tom https://prnt.sc/ne2onp He no longer has any Profile, even though it's required.

Does this behavior make sense for you? For me, it doesn't. :thinking:

[marionf]

Humm sorry @sarjon

Yes, you are right, it doesn't make sense.

What do you think if when you delete a profile, employees with this profile are disconnected from the BO like when you delete an employee account ? It could be better than stay logged in and have access to nothing ?

@colinegin wdyt about that ?

[sarjon]

It could be better than stay logged in and have access to nothing ?

I don't know. Maybe user who deletes Profile should be warned that this Profiles is used by 1 or more employees. And still, if we allow to delete Profile, this means that other Employees that used deleted Profile will become invalid from the code point of view, as Profile is required for every employee.

Maybe there could be option before deleting to assign new Profile for Employees.

[matks]

Or easier: refuse to delete a Profile if there are active Employees using it. This would prevent people from making mistakes.

[colinegin]

Thanks @marionf for pinging me on this !
I agree with you @matks, the easier the better : you cannot delete a profile if at least one employee has been assigned to this profile. By clicking on delete, there should be a pop up (or error message) asking the merchant to assign the employee with another profile before deleting this profile.
Are you all ok with this ?

[sarjon]

asking the merchant to assign the employee with another profile before deleting this profile.

Hmmm, what if there are a lot of employees? Let's say 10 or more? I think we might need a design mockup here.

[colinegin]

I don't know - why would a merchant remove a profile if ten of his employees are using it... ?

[sarjon]

I don't know - why would a merchant remove a profile if ten of his employees are using it

Who knows, maybe merchant is firing all employees. :stuck_out_tongue: Either way, we should be able to handle this situation, because we don't forbid it, it will happen at some point.

[colinegin]

I just discussed with @matks, what you're saying is true, but it means quite a lot of development (and we know there is still a lot of work to do ;)) for a situation which may never happen. And if this has to happen, the merchant won't have any problem to update employees profile one by one, he will just need a bit more time.
So let's keep it simple and do as Mathieu recommended :)

Thanks !

[matks]

Fixed by https://github.com/PrestaShop/PrestaShop/pull/13576