VirtueMart Forum

VirtueMart 2 + 3 + 4 => Virtuemart Development and bug reports => Topic started by: WebStuff on June 12, 2013, 18:53:29 PM

Title: [false alert; disable Cache]Security Bug - Other user details exposed.
Post by: WebStuff on June 12, 2013, 18:53:29 PM
PHP 5.4.6
Joomla! 2.5.11 Stable
Joomla Platform 11.4.0 Stable
VM 2.0.20b
No caching at all.
VM SEO on
JoomSEF

I was running a quick test on my live server today and added a product to the cart and went to cart page. Clicked the "Check Out Now" button which took me to the "add address, register or guest checkout form". At this point I pressed Cancel and was returned to a cart however it was not my cart it was in fact a customers who had just placed an order. All their address, email and phone details plus their cart contents were shown to me. I pressed refresh and was returned to my cart.
It was almost like it picked the wrong session to return me to.

I have not been able to recreate this but it is extremely concerning.

Thought I'd better let someone know.  :)
Title: Re: Security Bug - Other user details exposed.
Post by: Milbo on June 12, 2013, 20:04:48 PM
This is really strange.

You are sure that there is no cache? Usually that happens only, when you cachen the cart. Yes, I see that you know that.
Title: Re: Security Bug - Other user details exposed.
Post by: jjk on June 12, 2013, 20:19:54 PM
Did you check JoomSEF cache, too? Default is enabled. (Personally I think with Joomla 2.5.x and VM2.x there is no need for another SEF extension)
BTW - Here is a nice article about Joomla's cache features: http://www.theartofjoomla.com/joomla-caching-explained.html (http://www.theartofjoomla.com/joomla-caching-explained.html)
Title: Re: Security Bug - Other user details exposed.
Post by: luizwbr on June 13, 2013, 14:30:47 PM
Hi.

I went through the same problem when the cache the active site. In my case it was set to "file".

eg:
"website.com/cart.html"

I tested with 2 browsers on the same ip on different computers. I added a product to the cart in my browser and the other browser the same product appeared.

To fix this, I modified the plugin CacheControl to clear the cache when in view of the cart.

option=com_virtuemart&view=cart
I went through the same problem when the cache the active site. In my case it was enabled to "file".

eg:
"website.com / cart.html"

I tested with 2 browsers on the same ip on different computers. I added a product to the cart in my browser and the other browser the same product appeared.

I modified the plugin CacheControl to clear the cache when in view of the cart ( clean the cache using cacheCleaner plugin ):

function onAfterRoute(){
           
            if( $this->checkRules() && JFactory::getApplication()->isSite() ){
                $this->caching = JFactory::getConfig()->getValue('config.caching');
                JFactory::getConfig()->setValue('config.caching', 0);
               
                include_once JPATH_ROOT.DS.'plugins'.DS.'system'.DS.'cachecleaner'.DS.'helper.php';
                // carregar parĂ¢metros plugin
                $plugin_cc = JPluginHelper::getPlugin('system', 'cachecleaner');
                jimport( 'joomla.html.parameter' );
                $params = new JParameter($plugin_cc->params);

                $cch = new plgSystemCacheCleanerHelper($params,'clean',0,0);
                $cch->cleanCache($params,'clean',0);
               
            }
        }


Maybe if had a way to disable the cache only in view=cart or if we could pass a param like ?time=123456789 by VM default it could fix this problem.
Title: [SOLVED]Re: Security Bug - Other user details exposed.
Post by: WebStuff on June 14, 2013, 10:11:36 AM
Okay think I've solved this. I'm using JTouch template for Mobile which doesn't honour the Joomla Cache Settings and uses it's own settings but uses the Joomla cache folder and files.
So even though I was looking at the page on a Normal Desktop it was showing me info from a cached mobile phone session from the, now in use, Joomla cache.
I have disabled the cache in JTouch and all is well again.

Sorry for the false alarm.
Title: Re: [false alert; disable Cache]Security Bug - Other user details exposed.
Post by: Milbo on June 14, 2013, 11:39:05 AM
Seems jtouch and vm does not work well together, look here http://forum.virtuemart.net/index.php?topic=116345.msg392562#msg392562