0

We are looking for an extension for sending out offers from magento2 with a link to a shopping cart without the shopping cart being locked to a email address or a user. Does any1 know of an extension that is able to do this?

Right now we are using Email Quote Pro from Magecom, and this plugin is full of issues it seems.The first thing we noticed is that if people press the link there is a decent chance they will come to an empty cart for some reason, witch prompted us to do some testing. What we noticed when doing some testing is that the offers are locked to the email it has been sent out to, witch means we can copy the link location of the btn and just start guessing offer ids in the url, witch again means that if they guess the id of an offer that has been sent to a customer that has already bought from us and chosen to create and account, they will get into a shoppingcart with the name, address, email address, phone number and all the details they need to buy things by invoice in that customers name..

So we are suddenly very desperate to get a new extension here as this looks like it should be considered a pretty serious security flaw. I tried creating a ticket with magecomp on this issue but the response was not very helpful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.