0

Use case is that users need to be able to "pay off" an order eg. Yearly Fees of $200, the user might pay it off sporadically $5 or $10 at a time until order balance reaches $0.

Users are able to add payments through admin/commerce/orders/%/payment if the permission "Edit own orders" is active. This however means that the customer is able to edit the order details (prices, products, status etc.) which is a problem.

Is there a workaround for this? Im coming up blank.

1 Answer 1

0

Have found the answer in "commerce/modules/payment/commerce_payment.module"

Lines 964-972

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (!isset($order) || commerce_order_access('update', $order, $account)) {
      return TRUE;
    }
  }
  break;

need to be updated to the following

    // Creating new payment transactions.
case 'create':
  if (user_access('create payments', $account)) {
    // We currently allow any user to create any payment transaction,
    // regardless of the order, because entity_access() doesn't give us a
    // way to discriminate on the order.
    // @todo: find a way to prevent creating a payment transaction if the
    // user doesn't have access to the order.
    if (commerce_order_access('view', $order, $account)) {
      return TRUE;
    }
  }
  break;

This does not appear to have any security implications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.