I just upgraded to 4.7 from a CVS version that i was using. I have anonymous purchases turned on. The problem is that one anonymous user can see the order history (along with addresses and email addresses) of all other anonymous users. For instance the path:

http://www.mysite.com/store/history/0

is open for any anonymous user to browse. Can anyone suggest a good way to fix this?

CommentFileSizeAuthor
#4 store_11.patch589 bytessym

Comments

Jesse Grosjean’s picture

Jesse Grosjean commented

I'm just noticing that anonymous transactions are also visible to other anonymous users. For example if transaction 45 was made by an anonymous users then this path will be visible to any anonymous user visting the site:

http://www.mysite.com/store/transaction/view/45

Jesse

sym’s picture

sym commented

I too have this, and all the address info for my users is viewable by anyone...

sym’s picture

sym commented

As a quick fix, I've added


if (arg(2) != '0') {

arround the whole store_user_history function.

It just shows a blank page for now, but it should do the same thing as going to store/history does (access denied)

sym’s picture

sym commented
StatusFileSize
new store_11.patch589 bytes

Alright, here is an attempt to fix it.

I hope the patch works...last one I made went wrong...

This is a patch for CVS - should I make one for 4.7 as well?

gordon’s picture

gordon commented
Status: Active » Fixed

I have ported the fix from 4.6 which I did a while back. I don't know why this didn't get put in.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)