MAGETWO-37981: Incorrect action name checks leads to customer info leak

Dale Sikkema · Dale Sikkema · commit 5bd472c17977 · 2015-06-16T13:23:44.000-05:00
- undo fixed ACL resource
diff --git a/app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php b/app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php
@@ -373,7 +373,7 @@ protected function _reloadQuote()
      */
     protected function _isAllowed()
     {
-        return $this->_authorization->isAllowed('Magento_Sales::actions');
+        return $this->_authorization->isAllowed($this->_getAclResource());
     }
 
     /**

Original file line number	Diff line number	Diff line change
`@@ -373,7 +373,7 @@ protected function _reloadQuote()`
`373`	`373`	`*/`
`374`	`374`	`protected function _isAllowed()`
`375`	`375`	`{`
`376`		`- return $this->_authorization->isAllowed('Magento_Sales::actions');`
	`376`	`+ return $this->_authorization->isAllowed($this->_getAclResource());`
`377`	`377`	`}`
`378`	`378`
`379`	`379`	`/**`