diff --git a/src/Tests/Grand.Mapping.Tests/AdminShared/ContentMappingTests.Page_ToModel.verified.txt b/src/Tests/Grand.Mapping.Tests/AdminShared/ContentMappingTests.Page_ToModel.verified.txt
index de87b088d..495b64b26 100644
--- a/src/Tests/Grand.Mapping.Tests/AdminShared/ContentMappingTests.Page_ToModel.verified.txt
+++ b/src/Tests/Grand.Mapping.Tests/AdminShared/ContentMappingTests.Page_ToModel.verified.txt
@@ -16,5 +16,6 @@
   MetaDescription: About us,
   MetaTitle: About Us,
   SeName: about-us,
+  ShowCopyButton: false,
   Id: page-001
 }
\ No newline at end of file
diff --git a/src/Tests/Grand.Web.Store.Tests/Controllers/ShippingControllerTests.cs b/src/Tests/Grand.Web.Store.Tests/Controllers/ShippingControllerTests.cs
index a49a2cde4..fbf89ff47 100644
--- a/src/Tests/Grand.Web.Store.Tests/Controllers/ShippingControllerTests.cs
+++ b/src/Tests/Grand.Web.Store.Tests/Controllers/ShippingControllerTests.cs
@@ -101,7 +101,7 @@ public async Task RestrictionSave_AddRestriction_UpdateShippingMethod()
     {
         var country = new Country { Id = "countryId", Name = "Poland" };
         var customerGroup = new CustomerGroup { Name = "Guests" };
-        var shippingMethod = new ShippingMethod { Name = "Ground" };
+        var shippingMethod = new ShippingMethod { Name = "Ground", StoreId = StoreId };
         SetupCommonData(country, shippingMethod, customerGroup);
 
         var form = new Dictionary<string, string[]> {
@@ -124,7 +124,7 @@ public async Task RestrictionSave_NoFormValues_ClearExistingRestrictions()
     {
         var country = new Country { Id = "countryId", Name = "Poland" };
         var customerGroup = new CustomerGroup { Name = "Guests" };
-        var shippingMethod = new ShippingMethod { Name = "Ground" };
+        var shippingMethod = new ShippingMethod { Name = "Ground", StoreId = StoreId };
         shippingMethod.RestrictedCountries.Add(country);
         shippingMethod.RestrictedGroups.Add(customerGroup.Id);
         SetupCommonData(country, shippingMethod, customerGroup);
@@ -142,7 +142,7 @@ public async Task RestrictionSave_NoChanges_NotUpdateShippingMethod()
     {
         var country = new Country { Id = "countryId", Name = "Poland" };
         var customerGroup = new CustomerGroup { Name = "Guests" };
-        var shippingMethod = new ShippingMethod { Name = "Ground" };
+        var shippingMethod = new ShippingMethod { Name = "Ground", StoreId = StoreId };
         SetupCommonData(country, shippingMethod, customerGroup);
 
         var result = await _controller.RestrictionSave(new Dictionary<string, string[]>());
@@ -150,4 +150,25 @@ public async Task RestrictionSave_NoChanges_NotUpdateShippingMethod()
         Assert.IsInstanceOfType<RedirectToActionResult>(result);
         _shippingMethodServiceMock.Verify(s => s.UpdateShippingMethod(It.IsAny<ShippingMethod>()), Times.Never);
     }
+
+    [TestMethod]
+    public async Task RestrictionSave_GlobalShippingMethod_NotUpdated()
+    {
+        // GetAllShippingMethods(storeId) also returns global (StoreId=="") shipping methods, shared by
+        // every store - RestrictionSave must not mutate restrictions on a method it doesn't exclusively own.
+        var country = new Country { Id = "countryId", Name = "Poland" };
+        var customerGroup = new CustomerGroup { Name = "Guests" };
+        var globalShippingMethod = new ShippingMethod { Name = "Ground", StoreId = "" };
+        SetupCommonData(country, globalShippingMethod, customerGroup);
+
+        var form = new Dictionary<string, string[]> {
+            [$"restrict_{globalShippingMethod.Id}"] = ["countryId"]
+        };
+
+        var result = await _controller.RestrictionSave(form);
+
+        Assert.IsInstanceOfType<RedirectToActionResult>(result);
+        Assert.IsFalse(globalShippingMethod.RestrictedCountries.Any(c => c.Id == "countryId"));
+        _shippingMethodServiceMock.Verify(s => s.UpdateShippingMethod(It.IsAny<ShippingMethod>()), Times.Never);
+    }
 }
diff --git a/src/Web/Grand.Web.AdminShared/Models/Orders/OrderModel.cs b/src/Web/Grand.Web.AdminShared/Models/Orders/OrderModel.cs
index a5e8aff0d..6ae91032a 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Orders/OrderModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Orders/OrderModel.cs
@@ -345,6 +345,11 @@ public class UploadLicenseModel : BaseModel
         public string OrderItemId { get; set; }
 
         [UIHint("Download")] public string LicenseDownloadId { get; set; }
+
+        /// <summary>
+        /// Set by the controller after a successful save, so the popup view can signal the parent page to refresh.
+        /// </summary>
+        public bool RefreshPage { get; set; }
     }
 
     public class AddOrderProductModel : BaseModel
diff --git a/src/Web/Grand.Web.AdminShared/Models/Orders/PaymentTransactionModel.cs b/src/Web/Grand.Web.AdminShared/Models/Orders/PaymentTransactionModel.cs
index b0b91dc00..886229e52 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Orders/PaymentTransactionModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Orders/PaymentTransactionModel.cs
@@ -95,4 +95,10 @@ public class PaymentTransactionModel : BaseEntityModel
 
     [GrandResourceDisplayName("Admin.PaymentTransaction.Fields.PartialRefund.AmountToPaid")]
     public double AmountToPaid { get; set; }
+
+    /// <summary>
+    /// Set by the controller after a successful partial refund/paid, so the popup view can signal
+    /// the parent page to refresh.
+    /// </summary>
+    public bool RefreshPage { get; set; }
 }
\ No newline at end of file
diff --git a/src/Web/Grand.Web.AdminShared/Models/Pages/PageModel.cs b/src/Web/Grand.Web.AdminShared/Models/Pages/PageModel.cs
index c8320b104..21daa7c8e 100644
--- a/src/Web/Grand.Web.AdminShared/Models/Pages/PageModel.cs
+++ b/src/Web/Grand.Web.AdminShared/Models/Pages/PageModel.cs
@@ -96,6 +96,12 @@ public class PageModel : BaseEntityModel, ILocalizedModel<PageLocalizedModel>, I
     [GrandResourceDisplayName("Admin.Content.Pages.Fields.LimitedToStores")]
     [UIHint("Stores")]
     public string[] Stores { get; set; }
+
+    /// <summary>
+    /// True when the page is global or shared with more than one store, so a store manager may copy it
+    /// into their own store instead of editing it directly.
+    /// </summary>
+    public bool ShowCopyButton { get; set; }
 }
 
 public class PageLocalizedModel : ILocalizedModelLocal, ISlugModelLocal
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/Blog/Comments.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/Blog/Comments.cshtml
index 16f1e41a0..6a3b380f9 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/Blog/Comments.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/Blog/Comments.cshtml
@@ -1,8 +1,10 @@
-@inject AdminAreaSettings adminAreaSettings
+@using Grand.Web.Store.Models.Blogs
+@model BlogCommentListModel
+@inject AdminAreaSettings adminAreaSettings
 @{
     //page title
     ViewBag.Title = Loc["Admin.Content.Blog.Comments"];
-    string filterByBlogPostId = ViewBag.FilterByBlogPostId;
+    var filterByBlogPostId = Model.FilterByBlogPostId;
 }
 
 <div class="row">
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/MessageTemplate/Edit.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/MessageTemplate/Edit.cshtml
index e47a3d174..24a98da06 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/MessageTemplate/Edit.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/MessageTemplate/Edit.cshtml
@@ -1,8 +1,8 @@
-@model MessageTemplateModel
+@model MessageTemplateStoreModel
 @{
     ViewBag.Title = Loc["Admin.Content.MessageTemplates.EditMessageTemplateDetails"];
     Layout = Constants.LayoutStore;
-    var isReadOnly = (bool)(ViewBag.IsReadOnly ?? false);
+    var isReadOnly = Model.IsReadOnly;
 }
 <form asp-area="@Constants.AreaStore" asp-controller="MessageTemplate" asp-action="Edit" method="post">
 
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/Order/UploadLicenseFilePopup.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/Order/UploadLicenseFilePopup.cshtml
index 3b6571398..5ed1dfa16 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/Order/UploadLicenseFilePopup.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/Order/UploadLicenseFilePopup.cshtml
@@ -27,7 +27,7 @@
         </div>
     </div>
     <div asp-validation-summary="All"></div>
-    @if (ViewBag.RefreshPage == true)
+    @if (Model.RefreshPage)
     {
         <script>
             try {
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/Page/Edit.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/Page/Edit.cshtml
index 4262faa6d..e4b83f088 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/Page/Edit.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/Page/Edit.cshtml
@@ -32,7 +32,7 @@
                             <button class="btn btn-success" type="submit" name="save-continue">
                                 <i class="fa fa-check-circle"></i> @Loc["Admin.Common.SaveContinue"]
                             </button>
-                            @if (ViewBag.ShowCopyButton == true)
+                            @if (Model.ShowCopyButton)
                             {
                                 <button type="submit" form="page-copy-form" class="btn blue">
                                     <i class="fa fa-copy"></i> @Loc["Admin.Common.Copy"]
@@ -52,7 +52,7 @@
     </div>
 </form>
 <admin-delete-confirmation button-id="page-delete"/>
-@if (ViewBag.ShowCopyButton == true)
+@if (Model.ShowCopyButton)
 {
     <form id="page-copy-form" asp-area="@Constants.AreaStore" asp-controller="Page" asp-action="Copy" method="post">
         <input type="hidden" name="id" value="@Model.Id"/>
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyPaidPopup.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyPaidPopup.cshtml
index 0cbacceda..c1bab3fb9 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyPaidPopup.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyPaidPopup.cshtml
@@ -47,7 +47,7 @@
     </div>
 
     <div asp-validation-summary="All"></div>
-    @if (ViewBag.RefreshPage == true)
+    @if (Model.RefreshPage)
     {
         <script>
             try {
diff --git a/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyRefundPopup.cshtml b/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyRefundPopup.cshtml
index c1afd93e7..34188d004 100644
--- a/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyRefundPopup.cshtml
+++ b/src/Web/Grand.Web.Store/Areas/Store/Views/PaymentTransaction/PartiallyRefundPopup.cshtml
@@ -47,7 +47,7 @@
     </div>
 
     <div asp-validation-summary="All"></div>
-    @if (ViewBag.RefreshPage == true)
+    @if (Model.RefreshPage)
     {
         <script>
             try {
diff --git a/src/Web/Grand.Web.Store/Controllers/BlogController.cs b/src/Web/Grand.Web.Store/Controllers/BlogController.cs
index 7cac921c1..ec2886c66 100644
--- a/src/Web/Grand.Web.Store/Controllers/BlogController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/BlogController.cs
@@ -14,6 +14,7 @@
 using Grand.Web.Common.DataSource;
 using Grand.Web.Common.Filters;
 using Grand.Web.Common.Security.Authorization;
+using Grand.Web.Store.Models.Blogs;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Grand.Web.Store.Controllers;
@@ -92,7 +93,6 @@ public async Task<IActionResult> List(DataSourceRequest command)
     [PermissionAuthorizeAction(PermissionActionName.Create)]
     public async Task<IActionResult> Create()
     {
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = new BlogPostModel {
             //default values
             AllowComments = true,
@@ -118,7 +118,6 @@ public async Task<IActionResult> Create(BlogPostModel model, bool continueEditin
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         return View(model);
     }
 
@@ -142,7 +141,6 @@ public async Task<IActionResult> Edit(string id)
                 return RedirectToAction("List");
         }
 
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = blogPost.ToModel(_dateTimeService);
 
         //locales
@@ -188,7 +186,6 @@ public async Task<IActionResult> Edit(BlogPostModel model, bool continueEditing)
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         return View(model);
     }
 
@@ -285,8 +282,8 @@ public async Task<IActionResult> PicturePopup(PictureModel model)
 
     public IActionResult Comments(string filterByBlogPostId)
     {
-        ViewBag.FilterByBlogPostId = filterByBlogPostId;
-        return View();
+        var model = new BlogCommentListModel { FilterByBlogPostId = filterByBlogPostId };
+        return View(model);
     }
 
     [PermissionAuthorizeAction(PermissionActionName.List)]
@@ -450,7 +447,6 @@ public async Task<IActionResult> CategoryList(DataSourceRequest command)
     [PermissionAuthorizeAction(PermissionActionName.Create)]
     public async Task<IActionResult> CategoryCreate()
     {
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = new BlogCategoryModel();
         //locales
         await AddLocales(_languageService, model.Locales);
@@ -480,7 +476,6 @@ public async Task<IActionResult> CategoryCreate(BlogCategoryModel model, bool co
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         //locales
         await AddLocales(_languageService, model.Locales);
         return View(model);
@@ -497,7 +492,6 @@ public async Task<IActionResult> CategoryEdit(string id)
         if (!blogCategory.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
             return RedirectToAction(CategoryListAction);
 
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = blogCategory.ToModel();
         //locales
         await AddLocales(_languageService, model.Locales, (locale, languageId) =>
@@ -542,7 +536,6 @@ public async Task<IActionResult> CategoryEdit(BlogCategoryModel model, bool cont
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
 
         //locales
         await AddLocales(_languageService, model.Locales, (locale, languageId) =>
diff --git a/src/Web/Grand.Web.Store/Controllers/CategoryController.cs b/src/Web/Grand.Web.Store/Controllers/CategoryController.cs
index f67ed0255..22d220ba4 100644
--- a/src/Web/Grand.Web.Store/Controllers/CategoryController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/CategoryController.cs
@@ -1,5 +1,6 @@
 using Grand.Business.Core.Extensions;
 using Grand.Business.Core.Interfaces.Catalog.Categories;
+using Grand.Business.Core.Interfaces.Catalog.Products;
 using Grand.Business.Core.Interfaces.Common.Localization;
 using Grand.Domain.Permissions;
 using Grand.Infrastructure;
@@ -26,7 +27,8 @@ public CategoryController(
         ILanguageService languageService,
         ITranslationService translationService,
         IContextAccessor contextAccessor,
-        IPictureViewModelService pictureViewModelService)
+        IPictureViewModelService pictureViewModelService,
+        IProductService productService)
     {
         _categoryService = categoryService;
         _categoryViewModelService = categoryViewModelService;
@@ -34,6 +36,7 @@ public CategoryController(
         _translationService = translationService;
         _contextAccessor = contextAccessor;
         _pictureViewModelService = pictureViewModelService;
+        _productService = productService;
     }
 
     #endregion
@@ -46,6 +49,7 @@ public CategoryController(
     private readonly ITranslationService _translationService;
     private readonly IContextAccessor _contextAccessor;
     private readonly IPictureViewModelService _pictureViewModelService;
+    private readonly IProductService _productService;
 
     #endregion
 
@@ -276,6 +280,10 @@ public async Task<IActionResult> ProductList(DataSourceRequest command, string c
     [PermissionAuthorizeAction(PermissionActionName.Edit)]
     public async Task<IActionResult> ProductUpdate(CategoryModel.CategoryProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson("This is not your product");
+
         if (ModelState.IsValid)
         {
             await _categoryViewModelService.UpdateProductCategoryModel(model);
@@ -288,6 +296,10 @@ public async Task<IActionResult> ProductUpdate(CategoryModel.CategoryProductMode
     [PermissionAuthorizeAction(PermissionActionName.Edit)]
     public async Task<IActionResult> ProductDelete(CategoryModel.CategoryProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson("This is not your product");
+
         if (ModelState.IsValid)
         {
             await _categoryViewModelService.DeleteProductCategoryModel(model.Id, model.ProductId);
@@ -322,9 +334,26 @@ public async Task<IActionResult> ProductAddPopupList(DataSourceRequest command,
     [HttpPost]
     public async Task<IActionResult> ProductAddPopup(CategoryModel.AddCategoryProductModel model)
     {
+        var category = await _categoryService.GetCategoryById(model.CategoryId);
+        if (category == null || !category.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content("This is not your category");
+
         if (ModelState.IsValid)
         {
-            if (model.SelectedProductIds != null) await _categoryViewModelService.InsertCategoryProductModel(model);
+            //InsertCategoryProductModel mutates each selected product's ProductCategories collection,
+            //so every selected id must also belong to the current store.
+            if (model.SelectedProductIds != null)
+            {
+                var validIds = new List<string>();
+                foreach (var id in model.SelectedProductIds)
+                {
+                    var selected = await _productService.GetProductById(id);
+                    if (selected != null && selected.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                        validIds.Add(id);
+                }
+                model.SelectedProductIds = validIds.ToArray();
+                if (validIds.Any()) await _categoryViewModelService.InsertCategoryProductModel(model);
+            }
 
             return Content("");
         }
diff --git a/src/Web/Grand.Web.Store/Controllers/CollectionController.cs b/src/Web/Grand.Web.Store/Controllers/CollectionController.cs
index e172bdb1f..0d5103a37 100644
--- a/src/Web/Grand.Web.Store/Controllers/CollectionController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/CollectionController.cs
@@ -1,5 +1,6 @@
 using Grand.Business.Core.Extensions;
 using Grand.Business.Core.Interfaces.Catalog.Collections;
+using Grand.Business.Core.Interfaces.Catalog.Products;
 using Grand.Business.Core.Interfaces.Common.Directory;
 using Grand.Business.Core.Interfaces.Common.Localization;
 using Grand.Domain.Catalog;
@@ -29,7 +30,8 @@ public CollectionController(
         ILanguageService languageService,
         ITranslationService translationService,
         IGroupService groupService,
-        IPictureViewModelService pictureViewModelService)
+        IPictureViewModelService pictureViewModelService,
+        IProductService productService)
     {
         _collectionViewModelService = collectionViewModelService;
         _collectionService = collectionService;
@@ -38,6 +40,7 @@ public CollectionController(
         _translationService = translationService;
         _groupService = groupService;
         _pictureViewModelService = pictureViewModelService;
+        _productService = productService;
     }
 
     #endregion
@@ -51,6 +54,7 @@ public CollectionController(
     private readonly ITranslationService _translationService;
     private readonly IGroupService _groupService;
     private readonly IPictureViewModelService _pictureViewModelService;
+    private readonly IProductService _productService;
 
     #endregion
 
@@ -313,6 +317,10 @@ public async Task<IActionResult> ProductList(DataSourceRequest command, string c
     [HttpPost]
     public async Task<IActionResult> ProductUpdate(CollectionModel.CollectionProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson("This is not your product");
+
         if (ModelState.IsValid)
         {
             await _collectionViewModelService.ProductUpdate(model);
@@ -326,6 +334,10 @@ public async Task<IActionResult> ProductUpdate(CollectionModel.CollectionProduct
     [HttpPost]
     public async Task<IActionResult> ProductDelete(CollectionModel.CollectionProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson("This is not your product");
+
         if (ModelState.IsValid)
         {
             await _collectionViewModelService.ProductDelete(model.Id, model.ProductId);
@@ -362,9 +374,26 @@ public async Task<IActionResult> ProductAddPopupList(DataSourceRequest command,
     [HttpPost]
     public async Task<IActionResult> ProductAddPopup(CollectionModel.AddCollectionProductModel model)
     {
+        var collection = await _collectionService.GetCollectionById(model.CollectionId);
+        if (collection == null || !collection.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content("This is not your collection");
+
         if (ModelState.IsValid)
         {
-            if (model.SelectedProductIds != null) await _collectionViewModelService.InsertCollectionProductModel(model);
+            //InsertCollectionProductModel mutates each selected product's ProductCollections collection,
+            //so every selected id must also belong to the current store.
+            if (model.SelectedProductIds != null)
+            {
+                var validIds = new List<string>();
+                foreach (var id in model.SelectedProductIds)
+                {
+                    var selected = await _productService.GetProductById(id);
+                    if (selected != null && selected.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                        validIds.Add(id);
+                }
+                model.SelectedProductIds = validIds.ToArray();
+                if (validIds.Any()) await _collectionViewModelService.InsertCollectionProductModel(model);
+            }
             return Content("");
         }
 
diff --git a/src/Web/Grand.Web.Store/Controllers/MerchandiseReturnController.cs b/src/Web/Grand.Web.Store/Controllers/MerchandiseReturnController.cs
index 4f28f0b5c..c2bfcab1e 100644
--- a/src/Web/Grand.Web.Store/Controllers/MerchandiseReturnController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/MerchandiseReturnController.cs
@@ -230,6 +230,7 @@ public async Task<IActionResult> MerchandiseReturnNoteAdd(string merchandiseRetu
             return Json(new { Result = false });
 
         if (merchandiseReturn.StoreId != _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId) return Json(new { Result = false });
+        if (order.Id != merchandiseReturn.OrderId) return Json(new { Result = false });
 
         await _merchandiseReturnViewModelService.InsertMerchandiseReturnNote(merchandiseReturn, order, downloadId,
             displayToCustomer, message);
diff --git a/src/Web/Grand.Web.Store/Controllers/MessageTemplateController.cs b/src/Web/Grand.Web.Store/Controllers/MessageTemplateController.cs
index 9d80fa9c8..98c1e3baa 100644
--- a/src/Web/Grand.Web.Store/Controllers/MessageTemplateController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/MessageTemplateController.cs
@@ -2,14 +2,18 @@
 using Grand.Business.Core.Interfaces.Common.Localization;
 using Grand.Business.Core.Interfaces.Messages;
 using Grand.Business.Core.Interfaces.Storage;
+using Grand.Domain.Messages;
 using Grand.Domain.Permissions;
 using Grand.Infrastructure;
+using Grand.Infrastructure.Mapper;
 using Grand.SharedKernel;
+using Grand.Web.AdminShared.Extensions;
 using Grand.Web.AdminShared.Extensions.Mapping;
 using Grand.Web.AdminShared.Models.Messages;
 using Grand.Web.Common.DataSource;
 using Grand.Web.Common.Filters;
 using Grand.Web.Common.Security.Authorization;
+using Grand.Web.Store.Models.Messages;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Grand.Web.Store.Controllers;
@@ -165,10 +169,11 @@ public async Task<IActionResult> Edit(string id)
         if (messageTemplate.LimitedToStores && !messageTemplate.Stores.Contains(CurrentStoreId))
             return RedirectToAction("List");
 
-        // Global templates (LimitedToStores=false) are shown read-only
-        ViewBag.IsReadOnly = !messageTemplate.LimitedToStores;
+        var model = messageTemplate.MapTo<MessageTemplate, MessageTemplateStoreModel>();
 
-        var model = messageTemplate.ToModel();
+        // Global or multi-store-shared templates are shown read-only; only an exclusively-owned
+        // template (LimitedToStores && Stores == [CurrentStoreId]) can actually be saved (see Edit POST).
+        model.IsReadOnly = !messageTemplate.AccessToEntityByStore(CurrentStoreId);
         model.SendImmediately = !model.DelayBeforeSend.HasValue;
         model.HasAttachedDownload = !string.IsNullOrEmpty(model.AttachedDownloadId);
         model.AllowedTokens = messageTokenProvider.GetListOfAllowedTokens();
@@ -196,7 +201,7 @@ public async Task<IActionResult> Edit(MessageTemplateModel model, bool continueE
         if (messageTemplate == null)
             return RedirectToAction("List");
 
-        if (!messageTemplate.LimitedToStores || !messageTemplate.Stores.Contains(CurrentStoreId))
+        if (!messageTemplate.AccessToEntityByStore(CurrentStoreId))
             return RedirectToAction("List");
 
         var prevAttachment = messageTemplate.AttachedDownloadId;
@@ -249,7 +254,7 @@ public async Task<IActionResult> Delete(string id)
         if (messageTemplate == null)
             return RedirectToAction("List");
 
-        if (!messageTemplate.LimitedToStores || !messageTemplate.Stores.Contains(CurrentStoreId))
+        if (!messageTemplate.AccessToEntityByStore(CurrentStoreId))
             return RedirectToAction("List");
 
         await messageTemplateService.DeleteMessageTemplate(messageTemplate);
diff --git a/src/Web/Grand.Web.Store/Controllers/NewsController.cs b/src/Web/Grand.Web.Store/Controllers/NewsController.cs
index 4f16e8a2c..e931e9288 100644
--- a/src/Web/Grand.Web.Store/Controllers/NewsController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/NewsController.cs
@@ -71,7 +71,7 @@ public IActionResult List()
     [HttpPost]
     public async Task<IActionResult> List(DataSourceRequest command, NewsItemListModel model)
     {
-        var storeId = _contextAccessor.StoreContext.CurrentStore.Id;
+        var storeId = _contextAccessor.WorkContext.CurrentCustomer.StaffStoreId;
         var newsSettings = await _settingService.LoadSetting<NewsSettings>(storeId);
 
         var news = await _newsService.GetAllNews(storeId, command.Page - 1, command.PageSize, newsTitle: model.SearchNewsTitle);
@@ -93,7 +93,6 @@ public async Task<IActionResult> List(DataSourceRequest command, NewsItemListMod
     [PermissionAuthorizeAction(PermissionActionName.Create)]
     public async Task<IActionResult> Create()
     {
-        ViewBag.AllLanguages = _languageService.GetAllLanguages(true);
         var model = new NewsItemModel {
             //default values
             Published = true,
@@ -121,7 +120,6 @@ public async Task<IActionResult> Create(NewsItemModel model, bool continueEditin
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = _languageService.GetAllLanguages(true);
         return View(model);
     }
 
@@ -145,7 +143,6 @@ public async Task<IActionResult> Edit(string id)
                 return RedirectToAction("List");
         }
 
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = newsItem.ToModel(_dateTimeService);
         //locales
         await AddLocales(_languageService, model.Locales, (locale, languageId) =>
@@ -192,7 +189,6 @@ public async Task<IActionResult> Edit(NewsItemModel model, bool continueEditing)
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
 
         return View(model);
     }
diff --git a/src/Web/Grand.Web.Store/Controllers/OrderController.cs b/src/Web/Grand.Web.Store/Controllers/OrderController.cs
index 460ae46b9..fe9ac87d6 100644
--- a/src/Web/Grand.Web.Store/Controllers/OrderController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/OrderController.cs
@@ -612,7 +612,7 @@ public async Task<IActionResult> UploadLicenseFilePopup(OrderModel.UploadLicense
         await orderService.UpdateOrder(order);
 
         //success
-        ViewBag.RefreshPage = true;
+        model.RefreshPage = true;
 
         return View(model);
     }
@@ -637,9 +637,6 @@ public async Task<IActionResult> DeleteLicenseFilePopup(OrderModel.UploadLicense
         orderItem.LicenseDownloadId = null;
         await orderService.UpdateOrder(order);
 
-        //success
-        ViewBag.RefreshPage = true;
-
         return RedirectToAction("Edit", "Order", new { id = model.OrderId });
     }
 
diff --git a/src/Web/Grand.Web.Store/Controllers/PageController.cs b/src/Web/Grand.Web.Store/Controllers/PageController.cs
index 41ffb81ea..2bd66d41f 100644
--- a/src/Web/Grand.Web.Store/Controllers/PageController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/PageController.cs
@@ -118,7 +118,6 @@ public async Task<IActionResult> GlobalPagesList(DataSourceRequest command, Page
     [PermissionAuthorizeAction(PermissionActionName.Create)]
     public async Task<IActionResult> Create()
     {
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         var model = new PageModel {
             DisplayOrder = 1,
             Published = true
@@ -142,7 +141,6 @@ public async Task<IActionResult> Create(PageModel model, bool continueEditing)
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         await _pageViewModelService.PrepareLayoutsModel(model);
         return View(model);
     }
@@ -165,9 +163,8 @@ public async Task<IActionResult> Edit(string id)
                 return RedirectToAction("List");
         }
 
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
-        ViewBag.ShowCopyButton = !page.LimitedToStores || page.Stores.Count > 1;
         var model = page.ToModel(_dateTimeService);
+        model.ShowCopyButton = !page.LimitedToStores || page.Stores.Count > 1;
         model.Url = Url.RouteUrl("Page", new { SeName = page.GetSeName(_contextAccessor.WorkContext.WorkingLanguage.Id) }, Request.Scheme);
         await _pageViewModelService.PrepareLayoutsModel(model);
         await AddLocales(_languageService, model.Locales, (locale, languageId) =>
@@ -211,7 +208,6 @@ public async Task<IActionResult> Edit(PageModel model, bool continueEditing)
         }
 
         //If we got this far, something failed, redisplay form
-        ViewBag.AllLanguages = await _languageService.GetAllLanguages(true);
         model.Url = Url.RouteUrl("Page", new { SeName = page.GetSeName(_contextAccessor.WorkContext.WorkingLanguage.Id) }, "http");
         await _pageViewModelService.PrepareLayoutsModel(model);
         return View(model);
diff --git a/src/Web/Grand.Web.Store/Controllers/PaymentTransactionController.cs b/src/Web/Grand.Web.Store/Controllers/PaymentTransactionController.cs
index d029eb564..32f071ead 100644
--- a/src/Web/Grand.Web.Store/Controllers/PaymentTransactionController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/PaymentTransactionController.cs
@@ -427,7 +427,7 @@ await _mediator.Send(new PartiallyRefundOfflineCommand
             if (errors.Count == 0)
             {
                 //success
-                ViewBag.RefreshPage = true;
+                model.RefreshPage = true;
                 return View(model);
             }
 
@@ -488,7 +488,7 @@ public async Task<IActionResult> PartiallyPaidPopup(string id, bool online, Paym
             await _mediator.Send(new PartiallyPaidOfflineCommand
                 { PaymentTransaction = paymentTransaction, AmountToPaid = amountToPaid });
 
-            ViewBag.RefreshPage = true;
+            model.RefreshPage = true;
             return View(model);
         }
         catch (Exception exc)
diff --git a/src/Web/Grand.Web.Store/Controllers/ProductController.cs b/src/Web/Grand.Web.Store/Controllers/ProductController.cs
index 7e294e4e2..7cb0dfab3 100644
--- a/src/Web/Grand.Web.Store/Controllers/ProductController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/ProductController.cs
@@ -357,7 +357,6 @@ public async Task<IActionResult> LoadProductFriendlyNames(string productIds)
     public async Task<IActionResult> RequiredProductAddPopup(string productIdsInput)
     {
         var model = await _productViewModelService.PrepareAddRequiredProductModel(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId);
-        ViewBag.productIdsInput = productIdsInput;
         return View(model);
     }
 
@@ -401,6 +400,10 @@ public async Task<IActionResult> ProductCategoryList(DataSourceRequest command,
     [HttpPost]
     public async Task<IActionResult> ProductCategoryInsert(ProductModel.ProductCategoryModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
             try
             {
@@ -419,6 +422,10 @@ public async Task<IActionResult> ProductCategoryInsert(ProductModel.ProductCateg
     [HttpPost]
     public async Task<IActionResult> ProductCategoryUpdate(ProductModel.ProductCategoryModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
             try
             {
@@ -437,6 +444,10 @@ public async Task<IActionResult> ProductCategoryUpdate(ProductModel.ProductCateg
     [HttpPost]
     public async Task<IActionResult> ProductCategoryDelete(ProductModel.ProductCategoryModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteProductCategory(model.Id, model.ProductId);
@@ -472,6 +483,10 @@ public async Task<IActionResult> ProductCollectionList(DataSourceRequest command
     [HttpPost]
     public async Task<IActionResult> ProductCollectionInsert(ProductModel.ProductCollectionModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
             try
             {
@@ -490,6 +505,10 @@ public async Task<IActionResult> ProductCollectionInsert(ProductModel.ProductCol
     [HttpPost]
     public async Task<IActionResult> ProductCollectionUpdate(ProductModel.ProductCollectionModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
             try
             {
@@ -508,6 +527,10 @@ public async Task<IActionResult> ProductCollectionUpdate(ProductModel.ProductCol
     [HttpPost]
     public async Task<IActionResult> ProductCollectionDelete(ProductModel.ProductCollectionModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteProductCollection(model.Id, model.ProductId);
@@ -553,6 +576,10 @@ public async Task<IActionResult> RelatedProductList(DataSourceRequest command, s
     [HttpPost]
     public async Task<IActionResult> RelatedProductUpdate(ProductModel.RelatedProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId1);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.UpdateRelatedProductModel(model);
@@ -566,6 +593,10 @@ public async Task<IActionResult> RelatedProductUpdate(ProductModel.RelatedProduc
     [HttpPost]
     public async Task<IActionResult> RelatedProductDelete(ProductModel.RelatedProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId1);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteRelatedProductModel(model);
@@ -602,6 +633,10 @@ public async Task<IActionResult> RelatedProductAddPopupList(DataSourceRequest co
     [HttpPost]
     public async Task<IActionResult> RelatedProductAddPopup(ProductModel.AddRelatedProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             if (model.SelectedProductIds != null) await _productViewModelService.InsertRelatedProductModel(model);
@@ -649,6 +684,10 @@ public async Task<IActionResult> SimilarProductList(DataSourceRequest command, s
     [HttpPost]
     public async Task<IActionResult> SimilarProductUpdate(ProductModel.SimilarProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId1);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.UpdateSimilarProductModel(model);
@@ -662,6 +701,10 @@ public async Task<IActionResult> SimilarProductUpdate(ProductModel.SimilarProduc
     [HttpPost]
     public async Task<IActionResult> SimilarProductDelete(ProductModel.SimilarProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId1);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteSimilarProductModel(model);
@@ -698,6 +741,10 @@ public async Task<IActionResult> SimilarProductAddPopupList(DataSourceRequest co
     [HttpPost]
     public async Task<IActionResult> SimilarProductAddPopup(ProductModel.AddSimilarProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             if (model.SelectedProductIds != null) await _productViewModelService.InsertSimilarProductModel(model);
@@ -745,6 +792,10 @@ public async Task<IActionResult> BundleProductList(DataSourceRequest command, st
     [HttpPost]
     public async Task<IActionResult> BundleProductUpdate(ProductModel.BundleProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductBundleId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.UpdateBundleProductModel(model);
@@ -758,6 +809,10 @@ public async Task<IActionResult> BundleProductUpdate(ProductModel.BundleProductM
     [HttpPost]
     public async Task<IActionResult> BundleProductDelete(ProductModel.BundleProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductBundleId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteBundleProductModel(model);
@@ -794,6 +849,10 @@ public async Task<IActionResult> BundleProductAddPopupList(DataSourceRequest com
     [HttpPost]
     public async Task<IActionResult> BundleProductAddPopup(ProductModel.AddBundleProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             if (model.SelectedProductIds != null) await _productViewModelService.InsertBundleProductModel(model);
@@ -840,6 +899,10 @@ public async Task<IActionResult> CrossSellProductDelete(ProductModel.CrossSellPr
     {
         var product = await _productService.GetProductById(model.ProductId);
         if (product == null) throw new ArgumentException("Product not exists");
+
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         var crossSellProduct = product.CrossSellProduct.FirstOrDefault(x => x == model.Id);
         if (string.IsNullOrEmpty(crossSellProduct))
             throw new ArgumentException("No cross-sell product found with the specified id");
@@ -880,6 +943,10 @@ public async Task<IActionResult> CrossSellProductAddPopupList(DataSourceRequest
     [HttpPost]
     public async Task<IActionResult> CrossSellProductAddPopup(ProductModel.AddCrossSellProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             if (model.SelectedProductIds != null) await _productViewModelService.InsertCrossSellProductModel(model);
@@ -925,6 +992,10 @@ public async Task<IActionResult> RecommendedProductDelete(ProductModel.Recommend
     {
         var product = await _productService.GetProductById(model.ProductId);
         if (product == null) throw new ArgumentException("Product not exists");
+
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         var recommendedProduct = product.RecommendedProduct.FirstOrDefault(x => x == model.Id);
         if (string.IsNullOrEmpty(recommendedProduct))
             throw new ArgumentException("No recommended product found with the specified id");
@@ -965,6 +1036,10 @@ public async Task<IActionResult> RecommendedProductAddPopupList(DataSourceReques
     [HttpPost]
     public async Task<IActionResult> RecommendedProductAddPopup(ProductModel.AddRecommendedProductModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             if (model.SelectedProductIds != null) await _productViewModelService.InsertRecommendedProductModel(model);
@@ -1018,6 +1093,9 @@ public async Task<IActionResult> AssociatedProductUpdate(ProductModel.Associated
             if (associatedProduct == null)
                 throw new ArgumentException("No associated product found with the specified id");
 
+            if (!associatedProduct.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             associatedProduct.DisplayOrder = model.DisplayOrder;
             await _productService.UpdateAssociatedProduct(associatedProduct);
 
@@ -1037,6 +1115,9 @@ public async Task<IActionResult> AssociatedProductDelete(ProductModel.Associated
             if (product == null)
                 throw new ArgumentException("No associated product found with the specified id");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             await _productViewModelService.DeleteAssociatedProduct(product);
             return new JsonResult("");
         }
@@ -1070,9 +1151,26 @@ public async Task<IActionResult> AssociatedProductAddPopupList(DataSourceRequest
     [HttpPost]
     public async Task<IActionResult> AssociatedProductAddPopup(ProductModel.AddAssociatedProductModel model)
     {
+        var parentProduct = await _productService.GetProductById(model.ProductId);
+        if (parentProduct == null || !parentProduct.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
-            if (model.SelectedProductIds != null) await _productViewModelService.InsertAssociatedProductModel(model);
+            //InsertAssociatedProductModel reparents each selected product (writes ParentGroupedProductId on it),
+            //so every selected id must also belong to the current store, not just the parent.
+            if (model.SelectedProductIds != null)
+            {
+                var validIds = new List<string>();
+                foreach (var id in model.SelectedProductIds)
+                {
+                    var selected = await _productService.GetProductById(id);
+                    if (selected != null && selected.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                        validIds.Add(id);
+                }
+                model.SelectedProductIds = validIds.ToArray();
+                if (validIds.Any()) await _productViewModelService.InsertAssociatedProductModel(model);
+            }
             return Content("");
         }
 
@@ -1200,6 +1298,9 @@ public async Task<IActionResult> ProductPicturePopup(ProductModel.ProductPicture
             if (product == null)
                 throw new ArgumentException("No product found with the specified id");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                throw new ArgumentException(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             if (product.ProductPictures.FirstOrDefault(x => x.Id == model.Id) == null)
                 throw new ArgumentException("No product picture found with the specified id");
 
@@ -1217,6 +1318,10 @@ public async Task<IActionResult> ProductPicturePopup(ProductModel.ProductPicture
     [HttpPost]
     public async Task<IActionResult> ProductPictureDelete(ProductModel.ProductPictureModel model)
     {
+        var product = await _productService.GetProductById(model.ProductId);
+        if (product == null || !product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (ModelState.IsValid)
         {
             await _productViewModelService.DeleteProductPicture(model);
@@ -1297,6 +1402,9 @@ public async Task<IActionResult> ProductSpecAttrPopup(
             if (product == null)
                 return Content("Product not exists");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             var psa = product.ProductSpecificationAttributes.FirstOrDefault(x => x.Id == model.Id);
             if (psa == null)
                 await _productViewModelService.InsertProductSpecificationAttributeModel(model, product);
@@ -1334,6 +1442,9 @@ public async Task<IActionResult> ProductSpecAttrDelete(ProductSpecificationAttri
             if (product == null)
                 return Content("Product not exists");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             var psa = product.ProductSpecificationAttributes.FirstOrDefault(x => x.Id == model.Id);
             if (psa == null)
                 throw new ArgumentException("No specification attribute found with the specified id");
@@ -1529,6 +1640,9 @@ public async Task<IActionResult> ProductPriceInsert(ProductModel.ProductPriceMod
         if (product == null)
             throw new ArgumentException("No product found with the specified id");
 
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         if (product.ProductPrices.Any(x => x.CurrencyCode == model.CurrencyCode))
             throw new ArgumentException("Currency code exists");
 
@@ -1558,6 +1672,9 @@ public async Task<IActionResult> ProductPriceUpdate(ProductModel.ProductPriceMod
         if (product == null)
             throw new ArgumentException("No product found with the specified id");
 
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         var productPrice = product.ProductPrices.FirstOrDefault(x => x.Id == model.Id);
         if (productPrice == null)
             throw new ArgumentException("Product price model not exists");
@@ -1592,6 +1709,9 @@ public async Task<IActionResult> ProductPriceDelete(ProductModel.ProductPriceMod
         if (product == null)
             throw new ArgumentException("No product found with the specified id");
 
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
         var productPrice = product.ProductPrices.FirstOrDefault(x => x.Id == model.Id);
         if (productPrice == null)
             throw new ArgumentException("Product price model not exists");
@@ -1648,6 +1768,9 @@ public async Task<IActionResult> TierPriceCreatePopup(ProductModel.TierPriceMode
             if (product == null)
                 throw new ArgumentException("No product found with the specified id");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             var tierPrice = model.ToEntity(_dateTimeService);
             await _productService.InsertTierPrice(tierPrice, product.Id);
 
@@ -1716,6 +1839,9 @@ public async Task<IActionResult> TierPriceDelete(ProductModel.TierPriceDeleteMod
             if (product == null)
                 throw new ArgumentException("No product found with the specified id");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return ErrorForKendoGridJson(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             var tierPrice = product.TierPrices.FirstOrDefault(x => x.Id == model.Id);
             if (tierPrice == null)
                 throw new ArgumentException("No tier price found with the specified id");
@@ -1782,6 +1908,9 @@ public async Task<IActionResult> ProductAttributeMappingPopup(ProductModel.Produ
             if (product == null)
                 throw new ArgumentException("No product found with the specified id");
 
+            if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+                return Content(_translationService.GetResource("Admin.Catalog.Products.Permissions"));
+
             if (string.IsNullOrEmpty(model.Id))
                 await _productViewModelService.InsertProductAttributeMappingModel(model);
             else
@@ -1987,6 +2116,9 @@ public async Task<IActionResult> ProductAttributeValueCreatePopup(ProductModel.P
         if (product == null)
             throw new ArgumentException("No product found with the specified id");
 
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return RedirectToAction("List", "Product");
+
         var productAttributeMapping =
             product.ProductAttributeMappings.FirstOrDefault(x => x.Id == model.ProductAttributeMappingId);
         if (productAttributeMapping == null)
@@ -2043,6 +2175,9 @@ public async Task<IActionResult> ProductAttributeValueEditPopup(string productId
         if (product == null)
             throw new ArgumentException("No product found with the specified id");
 
+        if (!product.AccessToEntityByStore(_contextAccessor.WorkContext.CurrentCustomer.StaffStoreId))
+            return RedirectToAction("List", "Product");
+
         var pav = product.ProductAttributeMappings.FirstOrDefault(x => x.Id == model.ProductAttributeMappingId)
             ?.ProductAttributeValues.FirstOrDefault(x => x.Id == model.Id);
         if (pav == null)
diff --git a/src/Web/Grand.Web.Store/Controllers/SettingController.cs b/src/Web/Grand.Web.Store/Controllers/SettingController.cs
index 7afed8599..59cf921fc 100644
--- a/src/Web/Grand.Web.Store/Controllers/SettingController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/SettingController.cs
@@ -56,12 +56,14 @@ private async Task ClearCache()
 
     /// <summary>
     /// Returns true if the store owner is allowed to access (edit/delete) the given store-linked item.
-    /// Store owners can only access items that are explicitly assigned to their store
-    /// (LimitedToStores = true and their storeId is in the Stores collection).
-    /// Items available to all stores (LimitedToStores = false) are not editable by store owners.
+    /// Store owners can only access items exclusively assigned to their store
+    /// (LimitedToStores = true and Stores contains only their storeId).
+    /// Items available to all stores (LimitedToStores = false) or shared with other stores are not
+    /// editable/deletable by a single store owner - editing/deleting would silently affect every
+    /// other store the item is also assigned to.
     /// </summary>
     private static bool IsStoreOwnerAccessAllowed(string storeId, bool limitedToStores, ICollection<string> stores)
-        => string.IsNullOrEmpty(storeId) || (limitedToStores && stores.Contains(storeId));
+        => string.IsNullOrEmpty(storeId) || (limitedToStores && stores.Count == 1 && stores.Contains(storeId));
 
     #endregion
 
diff --git a/src/Web/Grand.Web.Store/Controllers/ShippingController.cs b/src/Web/Grand.Web.Store/Controllers/ShippingController.cs
index 7a88bbf45..515692fa5 100644
--- a/src/Web/Grand.Web.Store/Controllers/ShippingController.cs
+++ b/src/Web/Grand.Web.Store/Controllers/ShippingController.cs
@@ -637,7 +637,9 @@ public async Task<IActionResult> RestrictionSave(IDictionary<string, string[]> m
         var countries = await countryService.GetAllCountries(showHidden: true);
         var shippingMethods = await shippingMethodService.GetAllShippingMethods(storeId: CurrentStoreId);
         var customerGroups = await groupService.GetAllCustomerGroups();
-        foreach (var shippingMethod in shippingMethods)
+        //GetAllShippingMethods also returns global (StoreId=="") shipping methods, shared by every store;
+        //only mutate restrictions on methods this store manager exclusively owns.
+        foreach (var shippingMethod in shippingMethods.Where(x => x.StoreId == CurrentStoreId))
         {
             await SaveRestrictedCountries(model, shippingMethod, countries);
             await SaveRestrictedGroup(model, shippingMethod, customerGroups);
diff --git a/src/Web/Grand.Web.Store/Mapper/MessageTemplateStoreProfile.cs b/src/Web/Grand.Web.Store/Mapper/MessageTemplateStoreProfile.cs
new file mode 100644
index 000000000..93f0e3d0c
--- /dev/null
+++ b/src/Web/Grand.Web.Store/Mapper/MessageTemplateStoreProfile.cs
@@ -0,0 +1,22 @@
+using Grand.Domain.Messages;
+using Grand.Infrastructure.Mapper;
+using Grand.Mapping;
+using Grand.Web.Store.Models.Messages;
+
+namespace Grand.Web.Store.Mapper;
+
+public class MessageTemplateStoreProfile : Profile, IAutoMapperProfile
+{
+    public MessageTemplateStoreProfile()
+    {
+        CreateMap<MessageTemplate, MessageTemplateStoreModel>()
+            .ForMember(dest => dest.Locales, mo => mo.Ignore())
+            .ForMember(dest => dest.AllowedTokens, mo => mo.Ignore())
+            .ForMember(dest => dest.HasAttachedDownload, mo => mo.Ignore())
+            .ForMember(dest => dest.AvailableEmailAccounts, mo => mo.Ignore())
+            .ForMember(dest => dest.ListOfStores, mo => mo.Ignore())
+            .ForMember(dest => dest.IsReadOnly, mo => mo.Ignore());
+    }
+
+    public int Order => 0;
+}
diff --git a/src/Web/Grand.Web.Store/Models/Blogs/BlogCommentListModel.cs b/src/Web/Grand.Web.Store/Models/Blogs/BlogCommentListModel.cs
new file mode 100644
index 000000000..492b27387
--- /dev/null
+++ b/src/Web/Grand.Web.Store/Models/Blogs/BlogCommentListModel.cs
@@ -0,0 +1,9 @@
+namespace Grand.Web.Store.Models.Blogs;
+
+/// <summary>
+/// View model for the blog comments list page, optionally filtered to one blog post.
+/// </summary>
+public class BlogCommentListModel
+{
+    public string FilterByBlogPostId { get; set; }
+}
diff --git a/src/Web/Grand.Web.Store/Models/Messages/MessageTemplateStoreModel.cs b/src/Web/Grand.Web.Store/Models/Messages/MessageTemplateStoreModel.cs
new file mode 100644
index 000000000..f01be10db
--- /dev/null
+++ b/src/Web/Grand.Web.Store/Models/Messages/MessageTemplateStoreModel.cs
@@ -0,0 +1,12 @@
+using Grand.Web.AdminShared.Models.Messages;
+
+namespace Grand.Web.Store.Models.Messages;
+
+public class MessageTemplateStoreModel : MessageTemplateModel
+{
+    /// <summary>
+    /// True when the store manager can only preview the template (global, or shared with other stores),
+    /// not save changes to it.
+    /// </summary>
+    public bool IsReadOnly { get; set; }
+}