Customer Cart Crossing Problem

ZC Ver. 1.51
Database: MySQL 5.5.50-cll
PHP Version: 5.6.16 (Zend: 2.6.0)

Using CloudFlare for CDN.
Website used SSL.

I think I have stumble a big problem.
I have incidents where customer's cart somehow being pop randomly from 2 different locations.
So let's say Customer A in Florida put stuffs into cart, somehow Customer B in New York see contents of Customer A's cart for whatever reasons.

I don't think this is from code as it should not be that way.
I suspect that CloudFlare shared IP addresses that making customer's cart can possibly be cross referenced... and this is ABSOLUTELY UNACCEPTABLE.
As this breaks the Privacy/Security/Literary any regulations out there.

I wonder if Zen Cart ID can make it possible to prevent it? Or I must disable CloudFlare?

Sincerely, PanZC2020 (Friday, July 22nd, 2016)

This can/will happen during the shopping experience if two individuals share the same zenID in their URL, which is something that can happen if a link from the site is provided as presented when one first arrives at the site and a session has not begun... Any next link will include &zenID= and the hash text applicable to that session. In fact ask someone to goto the site using your own self created zenID and share that zenID with someone else. Once either of the two of you add something to the cart, then the other will see it in their cart at the next page navigation...

Link progression

https://homepromedical.com/cart/
https://homepromedical.com/cart/incontinence-c-82/adult-diapers-absorbent-briefs-c-82_122/
https://homepromedical.com/cart/incontinence-c-82/adult-diapers-absorbent-briefs-c-82_122/prevail-breezers-adult-briefs-p-594.html
https://homepromedical.com/cart/index.php?main_page=shopping_cart&number_of_uploads=0 [Add to Cart]
https://homepromedical.com/cart/index.php?main_page=login [Login as Customer]
https://homepromedical.com/cart/index.php?main_page=shopping_cart [View Cart]
https://www.homepromedical.com/cart/index.php?_ga=1.137373552.1544710830.1469194648 [Back to Homepage via Logo at top right]

So sometimes the GA (Google Analytics) showed up...
But, I'm thinking the main thing that can get ridiculous is the Zen ID part.
This can be scary as this means anyone can possibly spy the customer's cart.

It does happened, but seems it is happening more and more (as more people visited sites (Yes, the website does using Google's AdWord)).
I wonder if update will do anything with it?
Seems, this not really on CloudFlare as it is possibly more on Zen Cart ID thing.

Sincerely, PanZC2020 (Friday, July 22nd, 2016)

The only way anyone else would get an active shopper's zenid is if someone gives it to them.
Common ways for this are:
a) store administrator sends an advert/promo link to all customers, but includes zenid in that URL. Shouldn't do that.
b) customer copies and gives the link to their friends

A variant of (b) would be if you have some social-sharing service added to your site that mistakenly adds the zenid to the link that gets shared if your customer clicks on it.

Zen Cart never bases any shopping activities on the IP address.

Proxy/Caching services like CloudFlare might mistakenly give out wrong URLs containing zenid if configured to do so. But that's something to sort out with CloudFlare.

Thank you mc12345678 and DrByte for responses and hard word at Zen Cart project.

So, I decided to inspect stuffs into Zen ID.

I found 2 areas where it may possibly make Zen ID gone wack...

1. On the header, there is part of code contain Zen ID values

<input type="hidden" name="zenid" value="1f69a6bc67face285388e5e789ff9636" />

I decided to removed it.

2. In the Order Confirmation E-Mail... I found out that Footer E-Mail does have "zenid" attached with it.

So I think I will have to remove it off... possibly in e-mail template file, which is inside the "email" folder (if I remember right).

I will try these and see if problems persist and update as needed.
Thank you again for prompt replies!

Sincerely, PanZC2020 (Friday, July 22nd, 2016)

The hidden zenID is not a problem, in fact I thought removal of it would/could actually cause a problem, (regeneration of the zenID no? Or something similar?)

The presence of the zenID in the email, now that is something that was pointed out in other threads of the forum, it seems to relate to the condition of using zen_href_link to create the email link which, seeing that a uri rewriter appears to be used "might" factor into its presence, though whatever the case the zen_href_link could/should be formatted to exclude the zenID in the email's link association.

I would suggest also looking in the forum thread related to that uri rewriter (don't know if it is USU or hopefully not Simple URI rewriter) to see how that condition has been addressed...

Right. This is a problem with not upgrading, too.

Old Zen Cart version. Didn't upgrade to get bugfixes.
Old URL-Rewrite mod, with bugs, but didn't apply bugfixes.