Security Breach and Problem with Receipts - Help!

[JennaG]

Hi,

 

Didn't get a response yesterday, so I'm trying again.

 

I'm having two main problems now:

 

First is that when someone tries to check out, they often get the billing/shipping address of the previous customer filled in! These are people across the country, never signed in before, no cookie on their computers.

 

I have "spider sessions" turned off. How in the world could this be happening?

 

Second problem is with the order receipts sent to me. The customer's e-mail address isn't on the receipts. I need it because it's an online subscription. How do I get the order receipts to show e-mail addresses?

[Guest]

These are people across the country, never signed in before, no cookie on their computers.

session cookie is stored in the browser's memory.

The prevent spider sessions switch should be set to true.

 

For the emails change this in the catalog\checkout_process.php

 

// send emails to other people
 if (SEND_EXTRA_ORDER_EMAILS_TO != '') {
tep_mail('', SEND_EXTRA_ORDER_EMAILS_TO, EMAIL_TEXT_SUBJECT, $email_order, STORE_OWNER, STORE_OWNER_EMAIL_ADDRESS);
 }

 

to this

// send emails to other people
 if (SEND_EXTRA_ORDER_EMAILS_TO != '') {
  $email_owner . 'Order From: ' . $order->customer['email_address'] . "\n"\n" . $email_order;
tep_mail('', SEND_EXTRA_ORDER_EMAILS_TO, EMAIL_TEXT_SUBJECT, $email_owner, STORE_OWNER, STORE_OWNER_EMAIL_ADDRESS);
 }

[JennaG]

Thank you! I'll try that. But the "prevent spider sessions" IS set to "true," and I'm getting notes like this:

 

I logged onto your webite earlier today and instead of my

> > information being displayed the information of anothe rcustomer was

> > displayed. The first name was Dawn, I don't remember the rest. But, it

> > made me a littel nervous that all of her information would be

> > displayed on my computer screen. I wanted to notify of the problem.

[Guest]

Do a search with the major search engines for pages of your store. Check if the urls listed in the search results already include the session id (osCsid=xxxxxx....). If they do you may want to try one of the work around contributions or posts. Search for the forum/contributions for SID

[JennaG]

Thanks, Mark! It's weirder than that: yes, all of our own ordering links have session IDs. And this has never been a problem until we reloaded the store last week.

 

So, in other words, here's an ordering link for one of our classes:

 

http://store.absolutewrite.com/product_inf...26580273306001a

 

and here's another:

 

http://store.absolutewrite.com/shopping_ca...5aa2cc613c55453

 

That's bad? What should the links look like?

 

(Pardon me if I'm a little stupid... I'm not a techie and I didn't set up the store in the first place; I'm trying to learn as I go now.)

[Guest]

install the latest spiders.txt

http://www.oscommerce.com/community/contributions,2455

 

Get one of the sid killer contributions or workarounds posted.

 

The links should be indexed by SE without the sid. This is how they should look like. Finally to preserve the customers privacy you could also try this:

http://www.oscommerce.com/community/contributions,4112

 

and backup files before experimenting.