myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-27 16:52:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix critical unauthenticated order tampering/IDOR in api/orders.php and reused named-param bug in admin order search

Browse Source
This commit is contained in:
Myron Blair
2026-07-06 07:51:53 +00:00
parent 3c8e4d1dbc
commit f84a754370
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/orders.php
+4 -2
View File
@@ -45,8 +45,10 @@ if ($status) {
}
if ($search) {
$where[] = '(order_number LIKE :search OR customer_name LIKE :search OR customer_email LIKE :search)';
$params['search'] = '%' . $search . '%';
$where[] = '(order_number LIKE :search1 OR customer_name LIKE :search2 OR customer_email LIKE :search3)';
$params['search1'] = '%' . $search . '%';
$params['search2'] = '%' . $search . '%';
$params['search3'] = '%' . $search . '%';
}
if ($dateFrom) {
api/orders.php
+13 -4
View File
@@ -23,15 +23,22 @@ switch ($method) {
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
if (!$order) {
jsonResponse(['error' => 'Order not found'], 404);
}
// Only the admin or the customer who placed this order may view it by raw id.
$customer = CustomerAuth::getUser();
$isOwner = $customer && (string)$customer['customer_id'] === (string)$order['customer_id'];
if (!AdminAuth::isLoggedIn() && !$isOwner) {
jsonResponse(['error' => 'Unauthorized'], 401);
}
$order['items'] = json_decode($order['items'], true);
$order['shipping_address'] = json_decode($order['shipping_address'], true);
unset($order['id']);
jsonResponse($order);
} elseif ($orderNumber) {
$email = $_GET['email'] ?? '';
@@ -71,7 +78,9 @@ switch ($method) {
case 'POST':
// Update order status (admin)
if ($action === 'update_status') {
// Admin check would go here
if (!AdminAuth::isLoggedIn()) {
jsonResponse(['error' => 'Unauthorized'], 401);
}
$orderId = $input['order_id'] ?? '';
$status = $input['status'] ?? '';
$trackingNumber = $input['tracking_number'] ?? null;