CMS MADE SIMPLE FORGE

Orders

 
Back Back to List

[#9667] Customer can view other order details

avatar
Created By: cb2004 (cb2004)
Date Submitted: Wed Nov 13 08:09:55 -0500 2013

Assigned To: Robert Campbell (calguy1000)
Version: 1.15.2
CMSMS Version: 1.11.9
Severity: Critical
Resolution: Fixed
State: Open
Summary:
Customer can view other order details
Detailed Description:
When confirming an order, the url contains order_id=2. You can change that
number to anything and get the customers addresses and emails from that order.


History

Comments
avatar 
Date: 2013-11-13 08:35
Posted By: cb2004 (cb2004)

This is with anonymous checkout enabled.
avatar 
Date: 2014-12-20 14:15
Posted By: Robert Campbell (calguy1000)

fixed this a while ago
Updates

Updated: 2014-12-20 14:15
resolution_id: 5 => 7

Updated: 2013-11-13 08:35
resolution_id: => 5