Index: code/sites/all/modules/contrib/commerce_shipping/includes/commerce_shipping.checkout_pane.inc
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- code/sites/all/modules/contrib/commerce_shipping/includes/commerce_shipping.checkout_pane.inc	(date 1410514927000)
+++ code/sites/all/modules/contrib/commerce_shipping/includes/commerce_shipping.checkout_pane.inc	(revision )
@@ -178,6 +178,20 @@
  * Validate callback for recalculating shipping services.
  */
 function commerce_shipping_recalculate_services_validate($form, &$form_state) {
+
+  // Load latest version of the order.
+  $order = commerce_order_load($form_state['order']->order_id);
+  // Check if the order is still on the same checkout step.
+  $checkout_page = $form_state['checkout_page'];
+  if($form_state['order']->changed < $order->changed || !commerce_checkout_page_access($checkout_page, $order)){
+    // Clear all errors.
+    form_clear_error();
+    watchdog('access denied', check_plain($_GET['q']), NULL, WATCHDOG_WARNING);
+    drupal_set_message(t('You are not authorized to access this command.'), 'error');
+    $form_state['rebuild'] = TRUE;
+    return FALSE;
+  }
+
   // Call all validation callbacks.
   $recalculate = commerce_shipping_recalculate_services($form, $form_state);
 
@@ -283,11 +297,7 @@
 
   // Save the order and rebuild the form to reflect the updated customer data.
   if ($rebuild) {
-    // Avoid overwriting an already updated order.
-    $stored_order = commerce_order_load($order->order_id);
-    if ($stored_order->changed < $order->changed) {
-      commerce_order_save($order);
+    commerce_order_save($order);
-    }
     $form_state['rebuild'] = TRUE;
   }
 }