Hi, I was alerted to a curious anomaly today in AC9.

A user placed an order, and you can clearly see his email address is "email A" on his user record. "email A" is all you can see anywhere on his user record on the admin side.

His order email was sent to "email B", of which you can't find anywhere on his user record.

I looked in the DB, and found "email B" in the address record for his account. The email field on the address record isn't visible, editable, or otherwise accessible in any way that I could find on the back end admin screens, including on the address tab.

For now I'll fix the email address on the address record to match his user record, for this user only.

Thanks,
Charles

Hi, thanks for the reply.

This doesn't change the fact that the address can't be viewed or edited anywhere on the user profile?

Regarding the email address. I just want to provide some clarification.

1) The billing address can have a different email address than the user record. It is also known as the order email address and can only be changed via the order.

2) The user record can have its own email address, and this is typically also the login username. This can only be changed from the user's profile. It can be different from the user's billing email address.

The behaviors are the same as in Gold.

There is an EDIT ADDRESS button just below the billing address displayed on the Order Summary page.

The user's email can be changed from the User's Account. This is the EDIT USER page, first tab "Account Profile" just under the username field.

This is the default functionality for accounting programs and many other programs that deal with orders. Think of what you are asking. You have 100 orders that went to a specific customer to one address, and all of a sudden, on a new order, he/she decides to change it to a different address, that change could trickle through the previous 99 orders if the customer's address and order address had a one-to-one link.

This is not good in the event of an audit, a chargeback, or any type of audit trail.

The procedure being implemented by AbelCommerce is the proper one. Taking QuickBooks as an example, after you enter a bill, the address gets copied to the account, if you change it at the bill level, it will then prompt you with a dialogue box that says would you like this change to be reflected at the vendor level, for this or future bills. This can be implemented, as long as previous invoices and previous orders maintain their original addresses that were correct for that time frame.

The procedure above could be implemented in AbleCommerce.

Since your e-mail was not specific as to the detailed functionality to be able to edit information on the order and have it reflect back to the customer database, I needed to bring up the quick book example.

But, you need to be meticulous when you edit a previous order that will now have an entirely different address to be able that the older orders maintain the proper information.

Hello Charles,

There is an underlying problem here that has to do with the security implementation in AbleCommerce. Only two files are responsible for this, one that deals with what the user sees and one that deals with what the user does, they are both interconnected.

The concern is you have people who know how to modify these files and may want to keep order takers separated from the user database. If you allow a user, even in my scenario from QuickBooks, you would then have to go beyond these two files and start to manipulate functions.

It would be difficult for an administrator to limit the ability of an order taker and the customer database from just these two files.

The security function, per user, is something that lacks in AbleCommerce, and it's pretty difficult to address, probably one of the reasons it hasn't been touched.

Yes, I understand what you're saying, to have the information you're looking for just a click away and, in many ways being able to modify that information, but it's where the problems come in.

I hope this helps.
-Ray

You can change the phone and email for your account by logging in to the Members area and editing your profile.

/Members/MyAccountProfile page

Some of us, including myself, need to keep modules separated. This is why we modify these two files, so my order takers are restricted in the admin area.

I believe before 9.0.4, there was a minor glitch that led people in orders, to find their way into the customer module to make changes, but that was rectified in the newer version once I brought it up to their attention.

It appears that the separation of modules it's what's interfering with what you're trying to do, but from an owner, an accountant, and a person who has gone through multiple audits, I must restrict access to certain areas.

If I decide to restrict access to the customer module, I cannot have someone using the order module able to manipulate information on the customer module. I understand what you're trying to say about being able to view the information in the order module and try to make changes.

AbleCommerce is in a difficult situation trying to supply a product that's an all-in-one fit for all people. And yes, the ability to have better security and enable to apply user rights on a granule level would go a long way. You can look at numerous other shopping carts and the developer can add to it.

Assuming we're still talking about the admin section, it would be a disaster to have one-to-one links from orders to customers directly, one change can mess up multiple orders. The standard practice, it's the more common one that lets you take the customer information from the user profile and copy it over to the order information. But at that point, it's order information for that particular order.

Unless I'm missing something, and I probably am, entangling the two in relational links creates a lot more problems.

I have just gone through the back end, and I can modify every piece of information at the order level. I think many of us are being confused here; a step-by-step snapshot with pictures I believe we'll go a long way.

I apologize if I'm not being clear.

I am trying to state that if ANY field on a billing address record is visible and editable, ALL fields on the billing address record should be visible and editable.

For both admins and users!

Hi Ray, unless this changed from 9.0.7 to 9.0.8, this simply is not true.

The email field on the address record is not visible to the user or the admin.

I'm sure you know this, but to be 100% clear:

There are two tables with the email address:

1 - ac_users. This the field on the user profile, accessible and changeable by the user on /Members/MyCredentials (the left Profile menu option). This field is also visible and changeable by the admin on /Admin/User/EditUser/usernumber on the Account tab. Confusingly, updating this value on either of these screens ALSO updates the email address on the default billing address.

2 - ac_addresses. This field is NOT on the Address Book from the user's side in /Members/EditMyAddress?addressId=number. Nor is it on the admin side for Billing address on /Admin/User/EditUser/number on the Addresses tab.

There's only one place that I know of that the ac_addresses email field is displayed and changeable: during checkout, the billing info is shown and editable, and the email address appears here, and can be changed. You don't have to actually complete the order; just change the email during checkout, and the field on ac_addresses is updated and is now different from the email field on ac_users.

At this point no one can see the email on billing is different from email on profile, except the user during checkout OR on the billing address field on placed orders. Which, at I mentioned before, is already too late.

We discovered this because we had two users that had done this, and were asking why they weren't getting emails. We looked, and the user profile email address was quite correct. We eventually found the email is different on the order billing address, even though we can't see or edit that address anywhere!

And who would guess that updating the profile record (leaving the email address untouched) would then "fix" the email address on the billing record in ac_addresses!