| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| shopware/core | ≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7 | 6.7.3.16.6.10.7 |
| shopware/platform | ≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7 | 6.7.3.16.6.10.7 |
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí