I try to installing and use demo store by default. then i try to order products with anonymous account and next, next, checkout and complete.

Then i login with email sent to my email account and check my order status.

And below I find that I can change the order status and save it until complete. when I was a regular customer.

So, can we remove that order status in anonymous or authenticated user ? and display in Administrator or Store Administrator only.

CommentFileSizeAuthor
#1 Order Status select list22.05 KBguguss

Comments

guguss’s picture

guguss commented
Assigned: Unassigned » theo_
StatusFileSize
new Order Status select list22.05 KB

Thanks for reporting that issue.

The order status should be only displayed for "store administrator" and "administrator".

We'll fix that.

bojanz’s picture

bojanz commented
Assigned: theo_ » bojanz
MChall’s picture

MChall commented

Just wanted to check that the customer will be able to still see the status of the order (pending or complete), just not change it?

vasike’s picture

vasike
Location Ramnicu Valcea
commented
Assigned: bojanz » Unassigned
Status: Active » Needs review

It seems that "Commerce Backoffice" module adds this Order Status form for view order without any access.
Access added (update order permission) in the Gerrit commit : https://code.drupalcommerce.org/#/c/122/

@MChall : This is actually about advanced order management stuff, not customer(s) related.

vasike’s picture

vasike
Location Ramnicu Valcea
commented
Priority: Normal » Critical

this seems a serious "security" issue. please correct me if i'm wrong

guguss’s picture

guguss commented
Assigned: Unassigned » vasike
guguss’s picture

guguss commented
Status: Needs review » Fixed

Merged.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.