This plugin is dangerous!

  • dependencyinjection

    (@dependencyinjection)


    5 years, 8 months ago

    First, i like the plugin is pretty small and useful, BUT!

    If somebody will use email of already registered user while creating the order, this plugin will authenticate him without password automatically. Even if it’s administrator, no matter!

Viewing 1 replies (of 1 total)
  • Thread Starter dependencyinjection

    (@dependencyinjection)

    5 years, 8 months ago

    Found the reason:
    This happens if you don’t ask a user’s first name (for example, only surname, or even only email in cart fields).
    So, normally plugin make user authorized, place order, add this user to order and unauth user, but if there’s no first name, plugin doesn’t do logout, so you stay logged in!

Viewing 1 replies (of 1 total)

The topic ‘This plugin is dangerous!’ is closed to new replies.