Customer details revealed at base order URL

Question

If anyone visits http://site.com/commerce/customer/order they see the last order made even if they are not logged in and not related to that order in any way.

The customer can see their order info if they use http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder. Stripping the ? and the random string after it shows the last order.

I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:

{% extends '_layout' %}
{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).first() %}
{% if not order %}
    {% redirect 'commerce/customer' %}
{% endif %}

So it does not seem to be redirecting to commerce/customer.

Any help would be great.

Answer 1

As a rule in Commerce, when retrieving orders on client side templates, you should limit the retrieved orders to orders for the current customer only, using the customer parameter:

{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).customer(craft.commerce.customer).first() %}
{% if not order %}
    {% redirect 'login' %}  {# or wherever #}
{% endif %}

(...if the included example templates aren't doing that, you should let Luke know. I haven't looked at them in ages and don't have them to hand here...)

(One slightly random side thing I have noted with time is that you should really limit loading of the order complete page to a single time, i.e. only specifically at the actual order completion - if you don't, you tend to get issues with re-submissions of orders to your analytics and so forth. E.g. if the customer completes an order, goes somewhere on the site, then comes back to the complete page using the back button - it can create issues - so I remove the number parameter from the url using some JS and make sure I check for a number in the url in the cart/complete template:

{# Show empty cart if they somehow get back here without a number.... #}
{% set number = craft.request.param('number') %}
{% if not number %}
    {% redirect 'cart' %}
{% endif %}

And the JS would be something like:

if(window.location.pathname == "cart/complete"){
    var cleanedUrl = utilities.removeURLParameter(window.location.href, "number");
    window.history.pushState('',document.title,cleanedUrl);
}