Sign In
5
our company has just released a security patch which eliminates issues with arbitrary orders list viewing.
Although there is no way to view the detailed order information, it is strongly recommended to apply it to all your existing CS-Cart installations to avoid unauthorized viewing of your customers orders list.
Please download an appropriate version patch file from your File area and use it to overwrite /include/customer/orders.php script at all your CS-Cart stores.
Another way to update your store is to edit /include/customer/orders.php script manually .
Find the following text there:
} elseif (!empty($auth['order_ids'])) {
$query = "$db_tables[orders].order_id IN (".implode(',', $auth['order_ids']).")";
}
and replace it with this one:
} elseif (!empty($auth['order_ids'])) {
$query = "$db_tables[orders].order_id IN (".implode(',', $auth['order_ids']).")";
} else {
fn_set_exception('access_denied');
}
Feel free to contact our support team if you experience any problems or have any questions related to this issue.
