Keeping Credit Card Details hidden from 'Order Managers'

[aaronfrankel]

First, I guess I should ask the question if there really is a good reason to let 'Order Managers' be able to view customer credit card information by going into Payments and clicking on Account Details?

My second question is this, is there a way to edit this role to not show them the full credit card information or disallow viewing the credit card details all together? All of my staff from shipping to customer service go through a pre-employment screening process and background check, but then again they put locks on doors to keep honest people honest.

[jmestep]

You can change the permissions in the web.config file under the Admin/Payments folder. Here is the default:

Code: Select all

<?xml version="1.0"?>
<!-- 
    Note: As an alternative to hand editing this file you can use the 
    web admin tool to configure settings for your application. Use
    the Website->Asp.Net Configuration option in Visual Studio.
    A full list of settings and comments can be found in 
    machine.config.comments usually located in 
    \Windows\Microsoft.Net\Framework\v2.x\Config 
-->
<configuration>
  <system.web>
    <authorization>
      <allow roles="System,Admin,Jr. Admin,Manage Orders" />
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

[aaronfrankel]

Thanks!