[not a bug] security issue with shared cart url/link

[spyderrobotics]

Using v1.5.7c on my site and a customer was logged into their account and then was viewing a product.

They wanted to share that info with a friend and copied the URL and pasted into an email to the friend.

The friend pulled the link up on their computer and since the original account owner was still logged in on his computer the site let his friend see all his account info just as if he has logged in with email/password credentials.

I was able to recreate this. Is there something in the site that can be configured so that a even though another person has the zenid= in the link it doesn't consider them an account owner and log them in?

[spyderrobotics]

I found an old thread talking about this:

https://www.zen-cart.com/showthread....rce-Cookie-Use

I am not sure if this is still current for 1.5 zen versions and if there is a better way to handle it. I would think sharing a link with the zenid still shouldn't allow access to the account configuration portion. Do people have any problems with forcing cookies at this point?

[DrByte]

You will need to force cookie use for the zenid to disappear from the URL for regular shoppers. If the customer blocks cookies in their browser (which can be done in various ways, including some uses of incognito/private-browsing mode), then the fallback will be that the zenid gets added to the URL for that customer.