diff --git a/Controller/OrderController.php b/Controller/OrderController.php index 00f25b0..8820bea 100644 --- a/Controller/OrderController.php +++ b/Controller/OrderController.php @@ -52,12 +52,16 @@ public function displayOrderAction( OrderUser $shippingUser = null ) { + if ( ! $this->get('security.context')->isGranted('ROLE_SHOP_USER') ) { return new Response('The user should be authenticated on this page'); } + $em = $this->getDoctrine()->getManager(); + $order = $em->getRepository("KitpagesShopBundle:Order")->find($orderId); + if ( ($order->getUsername() != null) && ($order->getUsername() != $this->get('security.context')->getToken()->getUsername()) @@ -65,9 +69,6 @@ public function displayOrderAction( return new Response('You are not allowed to see this order'); } - $em = $this->getDoctrine()->getManager(); - $order = $em->getRepository("KitpagesShopBundle:Order")->find($orderId); - // modify ready_to_pay or created orders (and not payed or canceled orders) if ( ($order->getState() == OrderHistory::STATE_READY_TO_PAY) ||