Index: uc_order.module
===================================================================
RCS file: /cvs/drupal/contributions/modules/ubercart/uc_order/uc_order.module,v
retrieving revision 1.11.2.4
diff -u -p -r1.11.2.4 uc_order.module
--- uc_order.module	8 Feb 2008 22:22:39 -0000	1.11.2.4
+++ uc_order.module	11 Feb 2008 18:20:22 -0000
@@ -157,7 +157,7 @@ function uc_order_menu($may_cache) {
         'description' => t('View your order history.'),
         'callback' => 'uc_order_history',
         'callback arguments' => array(arg(1)),
-        'access' => user_access('view all orders') || $user->uid == arg(1),
+        'access' => user_access('view all orders') || ($user->uid == arg(1) && user_access('create orders')),
         'type' => MENU_LOCAL_TASK,
       );
       $items[] = array(
@@ -166,7 +166,7 @@ function uc_order_menu($may_cache) {
         'description' => t('View order !order_id.', array('!order_id' => arg(3))),
         'callback' => 'uc_order_view',
         'callback arguments' => array(arg(3), 'customer'),
-        'access' => user_access('view all orders') || $user->uid == arg(1),
+        'access' => user_access('view all orders') || ($user->uid == arg(1) && user_access('create orders')),
         'type' => MENU_CALLBACK,
       );
       $items[] = array(
@@ -175,7 +175,7 @@ function uc_order_menu($may_cache) {
         'description' => t('View order !order_id invoice.', array('!order_id' => arg(3))),
         'callback' => 'uc_order_view',
         'callback arguments' => array(arg(3), 'invoice'),
-        'access' => user_access('view all orders') || $user->uid == arg(1),
+        'access' => user_access('view all orders') || ($user->uid == arg(1) && user_access('create orders')),
         'type' => MENU_CALLBACK,
       );
     }
@@ -423,7 +423,7 @@ function uc_order_user($op, &$edit, &$ac
   global $user;
   switch ($op){
     case 'view':
-      if ($user->uid && ($user->uid == $account->uid || user_access('view all orders'))) {
+      if ($user->uid && user_access('create orders', $account) && ($user->uid == $account->uid || user_access('view all orders'))) {
         $items['orders'] = array(
           'value' => l(t('Click here to view your order history.'), 'user/'. $account->uid .'/orders'),
           'class' => 'member',