Have found the answer in "commerce/modules/payment/commerce_payment.module"
Lines 964-972
// Creating new payment transactions.
case 'create':
if (user_access('create payments', $account)) {
// We currently allow any user to create any payment transaction,
// regardless of the order, because entity_access() doesn't give us a
// way to discriminate on the order.
// @todo: find a way to prevent creating a payment transaction if the
// user doesn't have access to the order.
if (!isset($order) || commerce_order_access('update', $order, $account)) {
return TRUE;
}
}
break;
need to be updated to the following
// Creating new payment transactions.
case 'create':
if (user_access('create payments', $account)) {
// We currently allow any user to create any payment transaction,
// regardless of the order, because entity_access() doesn't give us a
// way to discriminate on the order.
// @todo: find a way to prevent creating a payment transaction if the
// user doesn't have access to the order.
if (commerce_order_access('view', $order, $account)) {
return TRUE;
}
}
break;
This does not appear to have any security implications.