{"data":{"id":"magento2-38279","source":"github-pr","sourceRef":"magento/magento2#38279","title":"add permission check for \"reload data\" data button","pr":{"number":38279,"url":"https://github.com/magento/magento2/pull/38279","author":"brosenberger","mergedAt":"2024-10-18T16:54:12Z","mergeCommit":"14454dea5f6a093fae0129270c651c2b60e19c5c","headCommit":"d3dc8c7b223a27ea82b0c1d8c34d719f23b11b96","baseRef":"2.4-develop","diffSha256":"6c05094f763b2df7186b79d7322a916c63a07e8994024c1620edd6e711bb4c79"},"issues":[{"number":38283,"url":"https://github.com/magento/magento2/issues/38283","title":"[Issue] add permission check for \"reload data\" data button","labels":["Area: Admin UI","Component: Reports","Issue: Confirmed","Priority: P2","Progress: done","Reported on 2.4.x","Reproduced on 2.4.x"],"kind":"pr-derived"}],"fixedIn":"2.4.8","containingTags":["2.4.8","2.4.8-p1","2.4.8-p2","2.4.8-p3","2.4.8-p4","2.4.8-p5","2.4.9"],"reportedOn":null,"codeMatch":{"2.4.6":"clean","2.4.6-p1":"clean","2.4.6-p2":"clean","2.4.6-p3":"clean","2.4.6-p4":"clean","2.4.6-p5":"clean","2.4.6-p6":"clean","2.4.6-p7":"clean","2.4.6-p8":"clean","2.4.6-p9":"clean","2.4.6-p10":"clean","2.4.6-p11":"clean","2.4.6-p12":"clean","2.4.6-p13":"clean","2.4.6-p14":"conflict","2.4.6-p15":"conflict","2.4.7":"clean","2.4.7-p1":"clean","2.4.7-p2":"clean","2.4.7-p3":"clean","2.4.7-p4":"clean","2.4.7-p5":"clean","2.4.7-p6":"clean","2.4.7-p7":"clean","2.4.7-p8":"clean","2.4.7-p9":"conflict","2.4.7-p10":"conflict","2.4.8":"conflict","2.4.8-p1":"conflict","2.4.8-p2":"conflict","2.4.8-p3":"conflict","2.4.8-p4":"conflict","2.4.8-p5":"conflict","2.4.9":"conflict"},"affectedVersions":["2.4.6","2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5","2.4.6-p6","2.4.6-p7","2.4.6-p8","2.4.6-p9","2.4.6-p10","2.4.6-p11","2.4.6-p12","2.4.6-p13","2.4.7","2.4.7-p1","2.4.7-p2","2.4.7-p3","2.4.7-p4","2.4.7-p5","2.4.7-p6","2.4.7-p7","2.4.7-p8"],"components":["magento/module-backend"],"files":[{"path":"app/code/Magento/Backend/view/adminhtml/templates/dashboard/totalbar/refreshstatistics.phtml","change":"modified","package":"magento/module-backend"}],"stripped":{"tests":[],"docs":[],"outsideCode":[]},"linesChanged":13,"mergeBatched":false,"excluded":null,"sections":{"description":null,"stepsToReproduce":"1. create a new user role, without the permission Magento_Reports::statistics\n2. create a new user with that role\n\nExpected:\n3. no \"Reload Data\" button is shown, as there is no permission for that \n\nActual:\n3. the \"Reload Data\" button is shown and clickable\n4. on click of the \"Reload Data\" button a \"not permitted\"-page is shown to the user","expectedResult":null,"actualResult":null,"source":"pr"},"signatures":[],"labels":{"area":["Admin UI"],"component":["Reports"],"priority":"P2","severity":null,"reportedOn":["2.4.x"]},"categories":["Admin","Reports"],"triage":{"model":"@cf/cloudflare/clef","requestHash":"2e07efb8f1187658be43d28e695b4489d103f2fe22ca18c3f5b9a37f173f6b01","isBugfix":0.9491,"changeKind":{"choice":"bugfix","probabilities":{"bugfix":0.9457,"feature":0.0199,"refactor":0.0183,"tests_only":0.0061,"docs_only":0.0051,"dependency":0.0049},"confidence":0.8742},"scope":{"score":0.5446,"probabilities":{"0":0.5247,"1":0.406,"2":0.0693},"confidence":0.1674},"risk":{"score":0.294,"probabilities":{"0":0.7307,"1":0.2446,"2":0.0247},"confidence":0.3915},"area":{"choice":"admin","probabilities":{"catalog":0.007,"checkout":0.0055,"customer":0.0056,"admin":0.9325,"graphql_api":0.0041,"framework":0.0115,"frontend":0.0176,"other":0.0162},"confidence":0.8519},"securityRelevant":0.8935,"reportedVersion":{"choice":"unspecified","probabilities":{"2.4.0":0.005,"2.4.0-p1":0.0051,"2.4.1":0.0049,"2.4.1-p1":0.0047,"2.4.2":0.008,"2.4.2-p1":0.0068,"2.4.2-p2":0.0077,"2.4.3":0.0127,"2.4.3-p1":0.0126,"2.4.3-p2":0.0118,"2.4.3-p3":0.0081,"2.4.4":0.0178,"2.4.4-p1":0.0123,"2.4.4-p10":0.008,"2.4.4-p11":0.0089,"2.4.4-p12":0.0076,"2.4.4-p13":0.0072,"2.4.4-p14":0.0096,"2.4.4-p15":0.0065,"2.4.4-p16":0.0087,"2.4.4-p17":0.0068,"2.4.4-p18":0.0059,"2.4.4-p2":0.003,"2.4.4-p3":0.0036,"2.4.4-p4":0.0037,"2.4.4-p5":0.0039,"2.4.4-p6":0.0046,"2.4.4-p7":0.0044,"2.4.4-p8":0.0052,"2.4.4-p9":0.0048,"2.4.5":0.0175,"2.4.5-p1":0.0135,"2.4.5-p10":0.0081,"2.4.5-p11":0.0137,"2.4.5-p12":0.0106,"2.4.5-p13":0.01,"2.4.5-p14":0.0094,"2.4.5-p15":0.0083,"2.4.5-p16":0.0096,"2.4.5-p17":0.0082,"2.4.5-p2":0.0035,"2.4.5-p3":0.0057,"2.4.5-p4":0.0051,"2.4.5-p5":0.005,"2.4.5-p6":0.0064,"2.4.5-p7":0.006,"2.4.5-p8":0.0053,"2.4.5-p9":0.0054,"2.4.6":0.0346,"2.4.6-p1":0.0223,"2.4.6-p10":0.0097,"2.4.6-p11":0.012,"2.4.6-p12":0.0117,"2.4.6-p13":0.0116,"2.4.6-p14":0.0101,"2.4.6-p15":0.0089,"2.4.6-p2":0.0055,"2.4.6-p3":0.0088,"2.4.6-p4":0.0093,"2.4.6-p5":0.0078,"2.4.6-p6":0.0092,"2.4.6-p7":0.0089,"2.4.6-p8":0.0074,"2.4.6-p9":0.0062,"2.4.7":0.0177,"2.4.7-p1":0.0161,"2.4.7-p10":0.0108,"2.4.7-p2":0.0095,"2.4.7-p3":0.014,"2.4.7-p4":0.0149,"2.4.7-p5":0.0127,"2.4.7-p6":0.0146,"2.4.7-p7":0.0127,"2.4.7-p8":0.0102,"2.4.7-p9":0.0062,"2.4.8":0.0195,"2.4.8-p1":0.0164,"2.4.8-p2":0.0192,"2.4.8-p3":0.0176,"2.4.8-p4":0.017,"2.4.8-p5":0.014,"2.4.9":0.0162,"unspecified":0.1855},"confidence":0.0331},"backportWorthy":{"score":1.4691,"probabilities":{"0":0.1225,"1":0.2858,"2":0.5917},"confidence":0.1702}},"curated":{"title":"The Reload Data button shows for admin users without the statistics permission","description":"On the admin dashboard, the Reload Data button is shown and clickable for a user without the Magento_Reports::statistics permission, and on click a not permitted page is shown. The refreshstatistics.phtml template now shows the button form only when isAllowed('Magento_Reports::statistics') is true.","categories":["Admin","Reports"],"author":"claude-code/opus-5.5","date":"2026-10-06","reviewedBy":null},"tests":null},"_documentation":"https://magento.watch/api","_description":"Upstream fix magento2-38279 details"}