1

Using Magento CE 1.9.2.0, I noticed that the print order page URL contains the order ID. For example: http://superawesome.store/sales/order/print/order_id/21/.

The presence of the order ID in the URL means that a customer can view other orders simply by changing the order ID, exposing the data of other customers.

I'm tempted to just disable the print order page for now while I look for ways to mitigate the risk of data exposure, but thought I'd ask you smart people if you know of a way to fix this issue.

1

With the code i can give you more description related to print action

from class abstract class Mage_Sales_Controller_Abstract

first magento calls

  public function printAction()
    {
        if (!$this->_loadValidOrder()) {
   ......

then call

  protected function _loadValidOrder($orderId = null)
    {
        if (null === $orderId) {
            $orderId = (int) $this->getRequest()->getParam('order_id');
        }
        if (!$orderId) {
            $this->_forward('noRoute');
            return false;
        }

        $order = Mage::getModel('sales/order')->load($orderId);

        if ($this->_canViewOrder($order)) {

you can see

 protected function _canViewOrder($order)
    {
        $customerId = Mage::getSingleton('customer/session')->getCustomerId();
        $availableStates = Mage::getSingleton('sales/order_config')->getVisibleOnFrontStates();
        if ($order->getId() && $order->getCustomerId() && ($order->getCustomerId() == $customerId)
            && in_array($order->getState(), $availableStates, $strict = true)
            ) {
            return true;
        }
        return false;
    }

above function is checking to show only valid order with associated customer only. Don't afraid about this. other customer can not see order from another customer.

hope this information will be helpful to understand your concern.

  • Thanks for the feedback! I should have done more testing! – Nikolas Adair Aug 15 '15 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.