Continuing on the bad practice described above - I have changed the .htaccess file to allow access to the uploaded images from IP address of the store owner - and created a link on the edit order...