Users add payments to order without editing order

Question

Use case is that users need to be able to "pay off" an order eg. Yearly Fees of $200, the user might pay it off sporadically $5 or $10 at a time until order balance reaches $0.

Users are able to add payments through admin/commerce/orders/%/payment if the permission "Edit own orders" is active. This however means that the customer is able to edit the order details (prices, products, status etc.) which is a problem.

Is there a workaround for this? Im coming up blank.

Answer 1

Have found the answer in "commerce/modules/payment/commerce_payment.module"

Lines 964-972

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (!isset($order) || commerce_order_access('update', $order, $account)) {
      return TRUE;
    }
  }
  break;

need to be updated to the following

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (commerce_order_access('view', $order, $account)) {
      return TRUE;
    }
  }
  break;

This does not appear to have any security implications.