View (Read Only) access for Drupal Commerce - Orders

Question

I have added 2 attributes into my Drupal Commerce Orders set of fields - Fivestar Rating & Review. My client needs me to show the ratings and reviews in "Testimonial" section of home page in ticker format. I was able to successfully integrating Rating + Review into Orders and show the testimonial section for users with role as Admin.

Below pictures show my configuration:

A chunk (Sidebar second) of my home page for Admin user with running ticker:

However, the anonymous visitor to the webiste is not able to view the contents of this ticker because anonymous does not has view access on the orders created in the website:

Now, ideally the orders (and hence the ratings and reviews inside the orders) should be accessible to the anonymous users. But yet, the ticker does not show any content and also the Orders page "/admin/commerce/orders" will not show any orders at all:

I need help with the following 2 items:

1. Why anonymous user is still not granted the view permission for the orders (and it's contents). How can I fix this?
2. I do see that there is a security implication even to provide "View" access to anonymous users on my Orders. How serious is this threat? Is there any safer way to get view access to orders and its contents? What is the right way of doing this?

Thanks for any efforts by the community to help me out :)

Answer 1

Inside your view, what are you access options (located under "Page Settings")? That would be a good place to start. Naturally clear the cache after every permission change.

I also don't think it would be wise to allow anonymous users to view any/all orders.