I know you guys have worked very hard on this update, but unfortunately, you have created a certain condition now with security that makes this software useless to us as is.

An order admin must have access to the user database, this is mandatory, you have removed this and it has now become a major problem for us.

One recommendation that comes to mind is to add a user admin group as well that will give order admin users access to the user database. Many times, operators will need to enter user information first before accepting an order.

Again I must voice my opinion on this topic, I love this software, but the security section is deplorable. You know it, everyone here knows it as well. I need a quick workaround please in order to rectify this issue.

Thank You

>>> Was an admin user in the Order Admins group able to add a user in 9.0.3? = YES

I will try to be as detailed as possible. This has to do under the admin group with the "order admin".

Under 9.0.3, an order admin still had access to the user database under the following conditions.

#1 - using the breadcrumbs which were listed on the upper right which have been removed under 9.0.4
#2 - going into an order and hitting customer profile which will take you to the user database

We were able under 9.03 to edit the "adminmenu.xml" file and restrict access to the menu on the left-hand side of the admin. We still gave our users access to the user database using the menu. But under 9.0.4, there is no way that a "order admin" can access the user database because they get kicked out.

The easiest way to fix this is to create a new user role called "user admin" that lets a member of this user group access the customer database. This would fix a large gap currently in the system. I know that to completely revamp the security section would be quite an undertaking, but I believe that by adding a new user role, that lets an admin access the user database, will go a long way.

This way I can create a custom admin group, in which both the "order admin" and the new role call "user admin" will be able to create new orders, create new customers, query existing customers to verify existing orders, query existing customers to verify past orders, and be in a better position to take care of customers when they call in on the phone.

Also, if the user doesn't have access to the catalog, why is there a hyperlink under the SKU names? It is very distracting, when users are manipulating orders to have your cursor highlight a product name, which of course my users will click on it and then take you to a completely different tab. Makes absolutely no sense whatsoever, if the user doesn't have access to the catalog in the first place, there should be no hyperlink as well.

Again, you guys have worked very hard, but I wear many hats, and one of them is dealing with customers, and this version now makes it very difficult to do so without major modifications by a developer, something I'm trying to avoid.

I hope I have explained it in the way that you could better understand.

Many thanks, please feel free to reach out if you have any additional questions. I am leaving now to the office and will not be back until 5:pm.

you can also update the adminmenu.xml and edit according to the access structure. please check the updates I made in the above post for the admin menu for the order admin role.

Customer Profile link is redirecting to Edit User page so you have to give the "Manage Orders" access to Edit User entry in the adminbreadcrumbs file.
Also to enable breadcrumbs on Edit user page, you have to then give the same access to all the parent entries.

Hope this helps!

Hi Ray,

Please go through these two posts. You had identified the issue with our breadcrumb implementation. The users were having access to the part of admin using breadcrumbs where they shouldn't be allowed.
We, in 9.0.4, improved this section and added roles attribute in breadcrumb XML entries.

I would recommend you to please go through the following links and then we can discuss this issue further.

Thanks

https://www.ablecommerce...urrent-security-settings
https://www.ablecommerce...ity-features-and-options

AdminBreadcrumb.xml:
Basically, this is used to render the breadcrumbs on the page to navigate to the related pages. In 9.0.4 we added roles attributes in XML entries and on the basis of these roles we restrict access to the pages. Because of this change, you were not able to access the user area for an order admin.

You can review the code added in CommerceBuilder.Web\Mvc\AbleAdminController.cs. Search the function OnActionExecuting() in this file.

AdminMenu.xml:
This file is only used for the rendering of the admin menu. We use the roles attribute in the XML entry to show/hide an admin menu.


It is not necessary to use both files in synchronization.

Can you please share a screenshot of the location you are referring to.

Thanks

Please look for \Website\Areas\Admin\Views\Orders\_OrderItemDetail.cshtml

Line # 5