Currently we have the problem, that users can buy/put products in the cart that they should not, because we have a function which is listening to the event checkout_cart_product_add_after. This Event is for example triggerd, if you try to add a product to the cart from the product detail page, or via URL (https://www.foobar.de/checkout/cart/add/product/1337/form_key/adsfXXddeee/).
Do you have a idea how the users can do this? Is this a known Magento bug?
PHP 5.6.x M1.9.2.4