How to implement order status change via email?

Question

1C-Bitrix

Hello.

The task is: The store manager receives a letter with a description of the order and the status. How to implement the ability to change the status of an order through a letter without authorization in the admin panel?

Has anyone done something similar? Or at least point to the thought pzhlst))

Answer 1

In the letter, you sew up a link to the service/page/section on the site, which will change the status of the desired order. In the parameters, pass the order ID and token (so that without authorization). You can generate a token based on an order (for example, "salt + order id + buyer's email") so that you can quickly compare it and not worry about storage.

Answer 2

It can't be done normally. Why? Authorization.
For good, order statuses should be changed only by those who have the right to do so, otherwise there is always the possibility that some attacker will do things.
Kmk, check of mail on the server will be the only more or less option.
Those. an [email protected] mailbox is made and we look at all incoming letters. In the subject, for example, pass the order ID. In the body of the letter or json or xml, in which you already pass additional parameters or without parameters at all, having previously determined the order status sequence.
The advantage is that the manager will not be tied to anything and can change statuses from any iron

Answer 3

To change the status directly from the letter
To the file /api/status.php

<?
require_once($_SERVER['DOCUMENT_ROOT'] . "/bitrix/modules/main/include/prolog_before.php");
use Bitrix\Sale;
$order = Sale\Order::load($_GET["ID"]);
$order->setField('STATUS_ID', $_GET["ST"]);
if ($_GET["KEY"] == 'AS456!00') {$order->save();};
?>

To the notification letter template, where for id use #ORDER_ID# (?ID=#ORDER_ID#)

<a href="https://www.mysite/api/status.php?ID=12456&ST=C&KEY=AS456!00">Отменить заказ>
<a href="https://www.mysite/api/status.php?ID=12456&ST=O&KEY=AS456!00">В обработку>

And you don't need any authorization.