0

I have added 2 attributes into my Drupal Commerce Orders set of fields - Fivestar Rating & Review. My client needs me to show the ratings and reviews in "Testimonial" section of home page in ticker format. I was able to successfully integrating Rating + Review into Orders and show the testimonial section for users with role as Admin.

Below pictures show my configuration:

Orders - Manage Fields

A chunk (Sidebar second) of my home page for Admin user with running ticker:

enter image description here

However, the anonymous visitor to the webiste is not able to view the contents of this ticker because anonymous does not has view access on the orders created in the website:

enter image description here

Now, ideally the orders (and hence the ratings and reviews inside the orders) should be accessible to the anonymous users. But yet, the ticker does not show any content and also the Orders page "/admin/commerce/orders" will not show any orders at all:

enter image description here

I need help with the following 2 items:

  1. Why anonymous user is still not granted the view permission for the orders (and it's contents). How can I fix this?
  2. I do see that there is a security implication even to provide "View" access to anonymous users on my Orders. How serious is this threat? Is there any safer way to get view access to orders and its contents? What is the right way of doing this?

Thanks for any efforts by the community to help me out :)

1

Inside your view, what are you access options (located under "Page Settings")? That would be a good place to start. Naturally clear the cache after every permission change.

I also don't think it would be wise to allow anonymous users to view any/all orders.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.