search

paynl / magento2-plugin

The Pay. plugin for Magento 2
https://www.pay.nl
28 stars 32 forks source link

Security issue when different store views using the same order reference ID #40

Closed istoutjesdijk closed 5 years ago

istoutjesdijk commented 5 years ago

When you place an order in store 1 with order number 1000123 including payment and later place an order in store 2 which get assigned the same order number (1000123). You will be redirected to the Pay.nl payment method of the order of store 1 and when you click back you will see all customer data of the client/order of store 1 including the contents of the cart.

andypieters commented 5 years ago

Are you sure this is the case? Orders are processed by the entity_id, which is the primary key in the database.

istoutjesdijk commented 5 years ago

Yes I reproduced the issue on a development area on Magento 2.3.1 with the latest Pay.nl plugin and also checked if the increment ID of the 2 orders would be the same but this is not the case. One customer even paid for the order of another customer.

Apparently something is based on the ordernumber during payment. I also checked other payment methods but these are fine.

andypieters commented 5 years ago

@istoutjesdijk Can you please contact us directly via support at pay.nl? so we can discuss details.