Fix #yogosha5832 - Missin test on permission for /index routes on APIs

htdocs/commande/class/api_orders.class.php

@@ -158,6 +158,10 @@ class Orders extends DolibarrApi
 	{
 		global $db, $conf;
 
+		if (!DolibarrApiAccess::$user->rights->commande->lire) {
+			throw new RestException(401);
+		}
+
 		$obj_ret = array();
 
 		// case of external user, $thirdparty_ids param is ignored and replaced by user's socid