Customer getting someone elses details

[newland]

Hi all

 

A customer of mine emailed me to say they recieved someone else details on checkout. I'm really confused about how this may have happened. Any one know hoe it could have happened?

 

My settings were:

Session Directory /tmp

Force Cookie Use False

Check SSL Session ID false

Check User Agent false

Check IP Address false

Prevent Spider Sessions False

Recreate Session False

 

I've now changed them to:

Session Directory /tmp

Force Cookie Use False

Check SSL Session ID True

Check User Agent True

Check IP Address True

Prevent Spider Sessions False

Recreate Session False

 

 

Also my configure.php file has the following settings:

define('USE_PCONNECT', 'false'); // use persistent connections?

define('STORE_SESSIONS', ''); // leave empty '' for default handler or set to 'mysql'

 

Should store sessions be set to mysql?

 

Cheers

Newland

[ozcsys]

You really should set the sessions to mysql.

 

Also you should use

 

Force Cookie Use False

Check SSL Session ID false

Check User Agent false

Check IP Address false

Prevent Spider Sessions true

Recreate Session False

[newland]

Cheers i'll make the change ASAP

 

You really should set the sessions to mysql.

 

Also you should use

 

Force Cookie Use False

Check SSL Session ID false

Check User Agent false

Check IP Address false

Prevent Spider Sessions true

Recreate Session False