User with permission "view own recurring fees" can vew and update profiles of other users fees.

I would like to report that this huge security issue still exists for

Ubercart 6.x-2.10
UC Recurring Payments and Subscriptions 6.x-2.0-beta2

The workaround is to disable view own recurring fees under permissions - however, users will be unable to update their own payment information.

Since this issue has persisted from Beta1 - Beta2, I am curious if the developer is working on a fix for this?

Can anyone verify that the fix posted in #1 did, in fact, work?

My basic testing of playing with URL variables after applying fix #1 shows that it does work to prevent users from viewing other recurring fee pages.

I have also tested manipulating the form action code to another /user/37/recurring/XX variable to ensure that users cannot still hack this to update other's payment information.
action="/user/37/recurring/2/update/authorizenet_cim?destination=user/37/recurring-fees"

So the fix appears to be working fine for me for both preventing users from viewing and changing payment information for other users.

This is also an issue in 7.x-2.x-dev. I've attached a patch that implements a slightly refactored version of VarnavskiyAI's changes in #1. I've done some light testing and this patch seems to solve the issue.

Committed to both 6.x and 7.x