Refer a Friend session ID attaching to referring email

24 Jan 2007, 6:33 AM

#1

Zen Follower

Join Date:: Nov 2006
Location:: New York City
Posts:: 248
Plugin Contributions:: 0

Refer a Friend session ID attaching to referring email

Hello.

I was testing my refer a friend feature and noticed that in the email received suggesting the product, that the zenid of the user who sent the referral was attached to the product link.

So, i couldn't find any threads on this, but are there any security concerns regarding this? If he/she who sent the referring link still had an active session, is it possible for the recipient to click on the link and be "logged-in" on the sender's account?

CONTRIBUTIONS:- ORDER DELIVERY DATE: http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=976

9 Feb 2007, 1:28 AM

#2

mrmeech

Zen Follower

Join Date:: Nov 2006
Location:: New York City
Posts:: 248
Plugin Contributions:: 0

Re: Refer a Friend session ID attaching to referring email

Is this not an issue? The lack of a response has me curious...

CONTRIBUTIONS:- ORDER DELIVERY DATE: http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=976

9 Feb 2007, 1:58 AM

#3

ajeh

Oba-san

Join Date:: Sep 2003
Location:: Ohio
Posts:: 62,757
Plugin Contributions:: 1

Re: Refer a Friend session ID attaching to referring email

What version of Zen Cart are you running?

Is this a clean install or an upgrade? If an upgrade, from what version and how did you do the upgrade?

Linda McGrath
If you have to think ... you haven't been zenned ...

**Did YOU buy the Zen Cart Team a cup of coffee and a donut today? Just click here to support the Zen Cart Team!!**

Are you using the latest? Perhaps you've a problem that's fixed in the latest version: [Upgrade today!]
Officially PayPal-Certified! Just click here

Try our Zen Cart Recommended Services - Hosting, Payment and more ...
Signup for our Announcements Forums to stay up to date on important changes and updates!

10 Feb 2007, 5:36 PM

#4

mattc

New Zenner

Join Date:: Jan 2005
Location:: UK
Posts:: 24
Plugin Contributions:: 0

Re: Refer a Friend session ID attaching to referring email

I am also seeing this on a clean install of 1.3.7 but only if the customer is using IE7. I cannot reproduce it using Firefox or Safari.

The ZenId is appended to the product link after a colon.

10 Feb 2007, 5:37 PM

#5

ajeh

Oba-san

Join Date:: Sep 2003
Location:: Ohio
Posts:: 62,757
Plugin Contributions:: 1

Re: Refer a Friend session ID attaching to referring email

Have you an URL to your site? This is really strange behavior to appear in the email as that is stripped out ...

Linda McGrath
If you have to think ... you haven't been zenned ...

**Did YOU buy the Zen Cart Team a cup of coffee and a donut today? Just click here to support the Zen Cart Team!!**

Are you using the latest? Perhaps you've a problem that's fixed in the latest version: [Upgrade today!]
Officially PayPal-Certified! Just click here

Try our Zen Cart Recommended Services - Hosting, Payment and more ...
Signup for our Announcements Forums to stay up to date on important changes and updates!

11 Feb 2007, 12:08 AM

#6

mattc

New Zenner

Join Date:: Jan 2005
Location:: UK
Posts:: 24
Plugin Contributions:: 0

Re: Refer a Friend session ID attaching to referring email

I can't reproduce this again now. I spotted it a few days ago and it was on my list of things to look into.

Sorry no link due to customer confidentiality.