If anyone visits http://site.com/commerce/customer/order they see the last order made even if they are not logged in and not related to that order in any way.
The customer can see their order info if they use http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder. Stripping the ? and the random string after it shows the last order.
I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:
{% extends '_layout' %}
{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).first() %}
{% if not order %}
{% redirect 'commerce/customer' %}
{% endif %}
So it does not seem to be redirecting to commerce/customer.
Any help would be great.