[jira] [Closed] (OFBIZ-13669) Anonymous ecommerce checkout accepts an arbitrary {{partyId}} and uses it to overwrite another party's name, and to attach caller-supplied contact details and a caller-supplied payment method to that party's account.

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13669?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13669.
---------------------------------
    Fix Version/s: Upcoming Branch
                   24.09.08
       Resolution: Fixed

> Anonymous ecommerce checkout accepts an arbitrary {{partyId}} and uses it to overwrite another party's name, and to attach caller-supplied contact details and a caller-supplied payment method to that party's account.
> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13669
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13669
>             Project: OFBiz
>          Issue Type: Bug
>          Components: order
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>             Fix For: Upcoming Branch, 24.09.08
>
>
> The ecommerce request-maps {{createUpdateShippingAddress}} and {{createUpdateBillingAndPayment}} are {{auth="false"}} and call {{createUpdateCustomerAndShippingAddress}} / {{createUpdateBillingAddressAndPaymentMethod}} in {{CheckoutServices.groovy}}, both also {{auth="false"}}. {{partyId}} is a caller-supplied {{INOUT optional}} attribute. The SECA {{setAnonUserLogin}}, and the wrappers themselves, rewrite {{userLogin.partyId = parameters.partyId}} whenever the session's login is the {{anonymous}} UserLogin. Every downstream check in this flow (party, contact-mech, and payment-method permission checks) is an ownership check of the form {{userLogin.partyId == partyId}}, so the rewrite satisfies all of them for any {{partyId}} the caller supplies.
> Reproduced live against a trunk instance with two independent anonymous HTTP sessions, neither logged in: a second session supplying a party id created by a first, unrelated session successfully overwrote that party's {{Person}} name fields in place, attached a new contact set ({{SHIPPING_LOCATION}}/{{PHONE_SHIPPING}}/{{PRIMARY_EMAIL}}) to that party, and attached a {{PaymentMethod}}/{{CreditCard}} to that party.
> h3. Suggested fix
> For the anonymous path, derive the party id only from the shopping cart ({{shoppingCart.getOrderPartyId()}} / {{getPartyId()}}), not from the request parameter. If a request {{partyId}} is supplied and differs from the cart's own party, reject the request with an error rather than acting on it. Remove the {{userLogin.partyId = parameters.partyId}} assignments in {{setAnonUserLogin}} and in both wrapper services once the cart is the source of truth.
> h3. Acceptance criteria
> * An anonymous checkout request cannot change, or attach data to, a party other than the one already associated with the caller's own shopping cart.
> * A request that supplies a {{partyId}} differing from the cart's own party fails with a clear error instead of silently succeeding or silently being ignored.
> * Existing anonymous first-time checkout (no prior party on the cart) continues to work unchanged.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)