Author Topic: Order details and invoice are public and searcheable in Google  (Read 2095 times)

Thomas Kampp

  • Jr. Member
  • **
  • Posts: 53
  • Joomla Developer
    • Toolmaster.dk
Re: Order details and invoice are public and searcheable in Google
« Reply #30 on: April 07, 2017, 15:28:23 pm »
Thanks :-)

A quick test reveals that there at least are some until 16. of February 2017. I have not looked further than this.
The problem about newer examples is that it takes time for Google to show new pages. So we can perhaps never show a truly fresh example.

What I am looking for right now is simply a way not to be able to download the PDF unless logged in. But can't find the relevant code in order to do this.
Danish Joomla Services: www.toolmaster.dk

Jörgen

  • Global Moderator
  • Full Member
  • *
  • Posts: 948
    • Kreativ Fotografi
  • VirtueMart Version: 3.0.19.9
Re: Order details and invoice are public and searcheable in Google
« Reply #31 on: April 07, 2017, 15:32:25 pm »
Hello

Check the Url for Reading the PDF. The virtuemart View is shown there.

regards

Jörgen @ Kreativ Fotografi
Joomla 3.6.5
Virtuemart 3.0.19.9
Olympiantheme Hera (customized)

Thomas Kampp

  • Jr. Member
  • **
  • Posts: 53
  • Joomla Developer
    • Toolmaster.dk
Re: Order details and invoice are public and searcheable in Google
« Reply #32 on: April 07, 2017, 17:09:40 pm »
Sadly no....

?option=com_virtuemart&view=invoice&layout=invoice&format=pdf&tmpl=component&virtuemart_order_id=**********

The view is invoice. So far so good, but there is no specific area for format pdf, resulting in the changes also destroys the normal invoice format.
Danish Joomla Services: www.toolmaster.dk

Jörgen

  • Global Moderator
  • Full Member
  • *
  • Posts: 948
    • Kreativ Fotografi
  • VirtueMart Version: 3.0.19.9
Re: Order details and invoice are public and searcheable in Google
« Reply #33 on: April 07, 2017, 21:28:43 pm »
Hello

You can check for pdf like this:
Code: [Select]
$invoiceformat = vRequest::getCmd('format','');
if ($invoiceformat == 'pdf') {
Your code here
}

If think You get what I mean :)

Jörgen @ Kreativ Fotografi
Joomla 3.6.5
Virtuemart 3.0.19.9
Olympiantheme Hera (customized)

Studio 42

  • Contributing Developer
  • Full Member
  • *
  • Posts: 2122
  • Joomla & Virtuemart addon developper
    • Studio 42 - Virtuemart & Joomla extentions
  • VirtueMart Version: 2.6 & 3.0.x.y
Re: Order details and invoice are public and searcheable in Google
« Reply #34 on: April 07, 2017, 23:40:16 pm »
You can check for referer using PHP $_SERVER['HTTP_REFERER'] to eliminate outside call and redirect to your index if this are from google search or other boot.


Jörgen

  • Global Moderator
  • Full Member
  • *
  • Posts: 948
    • Kreativ Fotografi
  • VirtueMart Version: 3.0.19.9
Re: Order details and invoice are public and searcheable in Google
« Reply #35 on: April 08, 2017, 10:36:05 am »
Hello Patrick

But as I understand this is a legitimate call, then the customer would not see the invoice either. How can we stop making this call get public? Only the customer should get this right. I thought this was fixed, right ? So we only have to take care of old invoice download requests, or am I wrong ?

regards

Jörgen @ Kreativ Fotografi
Joomla 3.6.5
Virtuemart 3.0.19.9
Olympiantheme Hera (customized)

Studio 42

  • Contributing Developer
  • Full Member
  • *
  • Posts: 2122
  • Joomla & Virtuemart addon developper
    • Studio 42 - Virtuemart & Joomla extentions
  • VirtueMart Version: 2.6 & 3.0.x.y
Re: Order details and invoice are public and searcheable in Google
« Reply #36 on: April 11, 2017, 02:46:00 am »
Jorgen, i think it's possible to filter comming from Google using HTTP_REFERER, so user comming from email have note same HTTP_REFERER.
I only gave this sugestion, of course if you don't filter corretly you stop user acces.
Anotehr possible filter, is to check if the order have a Joomla user account associate and force user login.
I think using the 2 system should stop most possible access and google.
You can use another system using an existing value as customer name for eg, so external cannot access to order if they don't know the customer name.
This can be done using a system plugin for eg.

Jörgen

  • Global Moderator
  • Full Member
  • *
  • Posts: 948
    • Kreativ Fotografi
  • VirtueMart Version: 3.0.19.9
Re: Order details and invoice are public and searcheable in Google
« Reply #37 on: April 11, 2017, 07:01:15 am »
Thank You Patrick

But right now it would be interesting to know why this is indexed by Google. I got the impression that Max had blocked that possibility. Is this something that only happens when You have Google analytics installed ?

best regards

Jörgen @ Kreativ Fotografi
Joomla 3.6.5
Virtuemart 3.0.19.9
Olympiantheme Hera (customized)