3

Today I a faced a confusing problem in my project.

let me introduce my project briefly.

I am creating a shop with drupal 7 and commerce module.

In my site 2 kinds of people exist. some people are seller and the others are customer. I have created a role called "SELLER" for seller users.

as you know each member has a specific page in his client area called "orders". in this page a member is able to see his orders (it is history of user orders)

and in drupal 7 permission, it is defined that each person is able to see his/her orders only. there is no permission to see the other people's orders. (ONLY ADMINISTRATORS CAN SEE ALL ORDERS)

but in my project, I want to give permission to the sellers to see the other people' orders that contains at least a product that the current seller has introduced.

let me give you an example. Imagine that we have a seller user in our site. his id is "seller_1" seller_1 is selling product_1, product_2 and product_3 in site.

now a new user we called him "customer_1" wants to but product_1 . he make an order and complete it. imagine that order number is "100".

now an order is saved in database and "customer_1" is able to see this order (order number 100) in orders page.

but in my plan the user "seller_1" must be able to see the order number 100 in a specific page that is created via a view.

=============================================

I tried to run this scenario but I have not found a solution yet.

in permission page, I gave "ability to see all orders" permission to seller roles. this modification solved my problem but it really breaks the security of site. because if we grant ability to see all orders to "SELLER" roles, the seller people are able to see all orders in the site even though there is no related product in the orders.

Now, do you have any suggestion for me?

Thanks a lot for your helps.

  • Did you add relationship in views between order and product? – Jayendra Kainthola Nov 6 '13 at 7:12
  • 1
    yes. I have relation sheep. I tested the view in administrator mode and it works with now problem, but when I try to see the view when I am logged as a seller user, I can't see the views results completely. I have explained the reasons completely in my topic. – Mehrdad201 Nov 6 '13 at 14:07
  • 1
    Please share your views, so we can check. – Jayendra Kainthola Nov 7 '13 at 4:35
  • 1
    Really I changed my solution. I add a new content type as a connector between orders and sellers. I had to save more data but I think security is more important. – Mehrdad201 Nov 12 '13 at 20:31
1

You would need to produce a custom permission using hook_permission that grants permission for sellers to see orders of their customers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.