diff --git a/src/accounting/account/views.py b/src/accounting/account/views.py
index e2fd9b0..cb0aad2 100644
--- a/src/accounting/account/views.py
+++ b/src/accounting/account/views.py
@@ -169,7 +169,7 @@ def delete_account(account: Account) -> redirect:
 
 
 @bp.get("/bases/<baseAccount:base>", endpoint="order")
-@has_permission(can_edit)
+@has_permission(can_view)
 def show_account_order(base: BaseAccount) -> str:
     """Shows the order of the accounts under a same base account.
 
diff --git a/src/accounting/templates/accounting/account/detail.html b/src/accounting/templates/accounting/account/detail.html
index d6ffcec..99b79fe 100644
--- a/src/accounting/templates/accounting/account/detail.html
+++ b/src/accounting/templates/accounting/account/detail.html
@@ -35,10 +35,12 @@ First written: 2023/1/31
       <i class="fa-solid fa-gear"></i>
       {{ A_("Settings") }}
     </a>
-    <a class="btn btn-primary" href="{{ url_for("accounting.account.order", base=obj.base)|append_next }}">
-      <i class="fa-solid fa-bars-staggered"></i>
-      {{ A_("Order") }}
-    </a>
+  {% endif %}
+  <a class="btn btn-primary" href="{{ url_for("accounting.account.order", base=obj.base)|append_next }}">
+    <i class="fa-solid fa-bars-staggered"></i>
+    {{ A_("Order") }}
+  </a>
+  {% if can_edit_accounting() %}
     <button class="btn btn-danger" type="button" data-bs-toggle="modal" data-bs-target="#delete-modal">
       <i class="fa-solid fa-trash"></i>
       {{ A_("Delete") }}
diff --git a/src/accounting/templates/accounting/account/order.html b/src/accounting/templates/accounting/account/order.html
index 966564b..c480b84 100644
--- a/src/accounting/templates/accounting/account/order.html
+++ b/src/accounting/templates/accounting/account/order.html
@@ -37,7 +37,7 @@ First written: 2023/2/2
   </a>
 </div>
 
-{% if base.accounts|length > 1 %}
+{% if base.accounts|length > 1 and can_edit_accounting() %}
   <form action="{{ url_for("accounting.account.sort", base=base) }}" method="post">
     <input id="csrf_token" type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     {% if "next" in request.args %}
@@ -69,11 +69,13 @@ First written: 2023/2/2
       </button>
     </div>
   </form>
-{% elif base.accounts|length == 1 %}
+{% elif base.accounts %}
   <ul class="list-group mb-3">
-    <li class="list-group-item">
-      {{ base.accounts[0] }}
-    </li>
+    {% for account in base.accounts|sort(attribute="no") %}
+      <li class="list-group-item">
+        {{ account }}
+      </li>
+    {% endfor %}
   </ul>
 {% else %}
   <p>{{ A_("There is no data.") }}</p>