1

Creating a user role to access only the VIEW action under sales order, does not deny the user from editing the billing and shipping address in the order information page.

enter image description here

Is there a way to fix it?

2
  1. Create your own controller replacing Mage_Adminhtml_Sales_OrderController.

  2. In your controller, create an _isAllowed method:

    /**
     * Acl check for admin
     *
     * @return bool
     */
    protected function _isAllowed()
    {
        $action = strtolower($this->getRequest()->getActionName());
    
        $aclResource = null;
        switch ($action) {
            case 'addressSave':
            case 'address':
                $aclResource = 'sales/order/actions/address';
                break;
        }
    
        if ($aclResource !== null) {
            return Mage::getSingleton('admin/session')->isAllowed($aclResource);
        }
    
        return parent::_isAllowed();
    }
    
  3. In your adminhtml.xml, add this:

    <config>
        <acl>
            <resources>
                <admin>
                    <children>
                        <sales>
                            <children>
                                <order>
                                    <children>
                                        <actions>
                                            <children>
                                                <address translate="title"><title>Edit Address</title></address>
                                            </children>
                                        </actions>
                                    </children>
                                </order>
                            </children>
                        </sales>
                    </children>
                </admin>
            </resources>
        </acl>
    <config>
    

    Now you can enable and disable the edit address screen for users.

  4. If you want to hide the link from these users, you can copy app/design/adminhtml/default/default/template/sales/order/view/info.phtml to your custom admin theme and replace

    <div class="tools"><?php echo $this->getAddressEditLink($_order->getBillingAddress())?></div>
    

    with something like this:

    <?php if (Mage::getSingleton('admin/session')->isAllowed('sales/order/actions/address')): ?>
    <div class="tools"><?php echo $this->getAddressEditLink($_order->getBillingAddress())?></div>
    <?php endif; ?>
    

    and do the same for the shipping address. Ideally you put the call to the singleton in your own block class but I put the code in the template file for the sake of brevity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.