Enterprise manager cannot edit 'about' details - bounced to user login screen about openfoodnetwork HOT 4 CLOSED

Confirmed in my dev environment, introduced in v4.4.47

• ✅ super admin: can save any enterprise details
• ✅ owner: can save any enterprise details
• ❌ manager: can view, but can't save any details
• ❌ manager of enterprise with permissions to edit profile: can view, but can't save any details
• ✅ manager of other enterprise: can't view or edit, unauthorised.

from openfoodnetwork.

I did a manual bisect of the last release and found that my pull request broke it:

• #12481

from openfoodnetwork.

Looking at the network request, the embedded form in the form contains an authenticity token. The form submission contains both tokens and the second one from the connected apps panel is used. This is probably raising the unauthorized error in Rails because the token doesn't match.

from openfoodnetwork.

I had another user report similar issues today, just now in Canada. I haven't had time to look into it yet, but when she was trying to download the product csv template she kept getting redirected to the login screen (when she was already logged in) and was getting an 'unauthorized' error.

from openfoodnetwork.