This started originally under the post "Better admin security features and options", I know that Katie was going to have someone look at this, but I wanted to share with you my findings.

Here are some of the hiccups with the current security system, I am basing this analysis on the "order manager" admin user settings, which only should have rights for orders and nothing else. Of course this is based on the original "adminmenu.xml" from Ablecommerce.

#1. When you go into an order, and you click the more button on the right and you go to customer profile, you now have a breadcrumb trail on the top, this can take you directly into the user area.

#2. If you edit any order, you will see that the item description is hyperlinked, so if you click on that, you now able to edit and manipulate products.

The quick solution would be remove the breadcrumb, and to remove the hyperlink from the product description in the order.

I hope this helps

PS: I still would love to see this security area of ablecommerce revamped, extremely weak.

Edited by user Friday, October 30, 2020 9:01:27 PM(UTC)  | Reason: Not specified