Security for Registered Shoppers

[omahonydonnelly]

We received an email today from an account holder: "I opened your website to shop today and discovered I am logged in as {name omitted}. I can see her orders, change her orders etc. This is not good security! Thought you might like to look into it."

 

It's been nearly a year since I set up OsCommerce for the site and I have no clue where to start. Anyone else have this issue, or know what I need to do to make sure it cannot happen again?

 

Thanks.

[Jack_mcs]

There are a number of things that can cause that. Check to see if you have this line in your configure file

define('STORE_SESSIONS', 'mysql');

Also check the cache settings in admin. If that is enabled, make sure it is using a private directory for storage.

 

Jack

[omahonydonnelly]

Thanks for the reply.

 

The config file does read:

define('STORE_SESSIONS', 'mysql');

 

Caching is enabled, but not a private directory -- do I need to change the permissions, or something else to do this?

[SCL Internet]

Sounds like this session problem, I've posted a solution in this thread....

 

http://www.oscommerce.com/forums/index.php?sho...=241614&hl=

[exbabylon]

did this fix your problem? I have the same issues with some of my clients, and have been trying to fix this for months.

 

Thank you,

 

Alex