Check ACL for customer link in order view (#2933)

OpenMage · Jan 14, 2023 · 29dd4b1 · 29dd4b1
1 parent 2d96091
commit 29dd4b1
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/Info.php b/app/code/core/Mage/Adminhtml/Block/Sales/Order/View/Info.php
@@ -74,6 +74,9 @@ public function getCustomerGroupName()
 
     public function getCustomerViewUrl()
     {
+        if (!Mage::getSingleton('admin/session')->isAllowed('customer/manage')) {
+            return false;
+        }
         if ($this->getOrder()->getCustomerIsGuest() || !$this->getOrder()->getCustomerId()) {
             return false;
         }