Hi All,
I've been looking into this for some time now and I think I'm getting close. I have a menu that's only accessible to registered users with 'VirtueMart » List Orders' set as the target. A logged in customer can browse to this page, but not to the order details - the URLs (in the correct format) return an error: "Order not found! It may have been deleted.", however browsing to the same URL when logged in as a Super User provides access to the order details.
I followed instructions here: https://docs.virtuemart.net/manual/general-concepts/44-multivendor/197-example-to-setup-acl.html, specifically this part:
Allow viewing of Orders but no edit or update of status
- "Order access" => Allowed
- "Orders edit" => Not Allowed (Denied)
- "Order status change" => Not Allowed (Denied)
but it only seems to work if I provide all shoppers with access to "VM Manager" which sounds like a big security risk. Is this correct? If so, what's the recommended approach to provide all customers with this visibility? I've read that giving access to the 'Registered' group is unwise but I don't know how else it would work...
I can't imagine you'd need it, but I'm currently testing on Joomla! 3.9.6 Stable / VirtueMart 3.4.2
This will work without any acl changes.
Assign a menu item with user account and it should work. Check that you have not restricted access for "order tracking mode" in vm configuration->checkout.
Jörgen @ Kreativ Fotografi
Aha! Thank you! that's exactly what I wanted.