I have a customer group store_admin. If a customer belongs to store_admin, he should be able to view the orders placed by other customers.

I am unable to find out where does Magento check for logged in customer and how does it restrict access.

Any help would be appreciated. Thanks!

1 Answer 1


Take a look on the class: Magento\Sales\Block\Order\History at the method getOrders() this method is responsible for order collection at frontend customer account page.

If you want to change anything at collection then you have to work getOrders()

For this requirement, you need to override that class Create di.xml at app/code/{Vendorname}/{Modulename}/etc/frontend/ and put the below code:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Magento\Sales\Block\Order\History" type="{Vendorname}\{Modulename}\Sales\Block\Order\History" />

Rewrite class


namespace {Vendorname}\{Modulename}\Sales\Block\Order;

class History extends \Magento\Sales\Block\Order\History
    public function __construct(
        \Magento\Framework\View\Element\Template\Context $context,
        \Magento\Sales\Model\ResourceModel\Order\CollectionFactory $orderCollectionFactory,
        \Magento\Customer\Model\Session $customerSession,
        \Magento\Sales\Model\Order\Config $orderConfig,
        array $data = [])
        parent::__construct($context, $orderCollectionFactory, $customerSession, $orderConfig, $data);
    public function getOrders()
        if (!($customerId = $this->_customerSession->getCustomerId())) {
            return false;
        if (!$this->orders) {
            if($this->_customerSession->getCustomerGroupId() == '{store_admin_GROUP_CODE_ID}')
                $this->orders = $this->getOrderCollectionFactory()->create()->setOrder(
                return $this->orders;
                return parent::getOrders();
        return parent::getOrders();


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.