From 3a2efffbcd0e61f96e2346cd8e66c5b0cf82c75b Mon Sep 17 00:00:00 2001 From: Ivan Bochkarev Date: Thu, 16 Jul 2026 00:51:32 +0600 Subject: [PATCH] fix(customer): stop checkout token takeover via email (#369) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a guest checkout matches an existing msCustomer by email, attach the order only — do not overwrite token or auto-login the attacker. --- .../src/Controllers/Customer/Customer.php | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/core/components/minishop3/src/Controllers/Customer/Customer.php b/core/components/minishop3/src/Controllers/Customer/Customer.php index 1157ee57..ebf23747 100644 --- a/core/components/minishop3/src/Controllers/Customer/Customer.php +++ b/core/components/minishop3/src/Controllers/Customer/Customer.php @@ -428,12 +428,9 @@ public function getOrCreate(?array $orderData = null): int $email = $orderData['address_email'] ?? ''; if (!empty($email)) { + // Link order to existing account by email only. + // Never overwrite msCustomer.token — that hands the guest session the victim's account. $msCustomer = $this->findByEmail($email); - - if ($msCustomer) { - $msCustomer->set('token', $this->token); - $msCustomer->save(); - } } if (empty($msCustomer)) { @@ -555,16 +552,8 @@ protected function createFromOrderData(array $orderData): ?msCustomer $this->autoLoginCustomer($msCustomer); } } else { + // Email already registered: attach order only — no token/session takeover $msCustomer = $this->findByEmail($email); - - if ($msCustomer) { - $msCustomer->set('token', $this->token); - $msCustomer->save(); - - if ($autoLogin) { - $this->autoLoginCustomer($msCustomer); - } - } } } }