[false alert; disable Cache]Security Bug - Other user details exposed.

[WebStuff]

PHP 5.4.6
Joomla! 2.5.11 Stable
Joomla Platform 11.4.0 Stable
VM 2.0.20b
No caching at all.
VM SEO on
JoomSEF

I was running a quick test on my live server today and added a product to the cart and went to cart page. Clicked the "Check Out Now" button which took me to the "add address, register or guest checkout form". At this point I pressed Cancel and was returned to a cart however it was not my cart it was in fact a customers who had just placed an order. All their address, email and phone details plus their cart contents were shown to me. I pressed refresh and was returned to my cart.
It was almost like it picked the wrong session to return me to.

I have not been able to recreate this but it is extremely concerning.

Thought I'd better let someone know. 

[Milbo]

This is really strange.

You are sure that there is no cache? Usually that happens only, when you cachen the cart. Yes, I see that you know that.

[jjk]

Did you check JoomSEF cache, too? Default is enabled. (Personally I think with Joomla 2.5.x and VM2.x there is no need for another SEF extension)
BTW - Here is a nice article about Joomla's cache features: http://www.theartofjoomla.com/joomla-caching-explained.html

[luizwbr]

Hi.

I went through the same problem when the cache the active site. In my case it was set to "file".

eg:
"website.com/cart.html"

I tested with 2 browsers on the same ip on different computers. I added a product to the cart in my browser and the other browser the same product appeared.

To fix this, I modified the plugin CacheControl to clear the cache when in view of the cart.

option=com_virtuemart&view=cart
I went through the same problem when the cache the active site. In my case it was enabled to "file".

eg:
"website.com / cart.html"

I tested with 2 browsers on the same ip on different computers. I added a product to the cart in my browser and the other browser the same product appeared.

I modified the plugin CacheControl to clear the cache when in view of the cart ( clean the cache using cacheCleaner plugin ):

Code Select Expand

function onAfterRoute(){
           
            if( $this->checkRules() && JFactory::getApplication()->isSite() ){
                $this->caching = JFactory::getConfig()->getValue('config.caching');
                JFactory::getConfig()->setValue('config.caching', 0);
               
                include_once JPATH_ROOT.DS.'plugins'.DS.'system'.DS.'cachecleaner'.DS.'helper.php';
                // carregar parâmetros plugin
                $plugin_cc = JPluginHelper::getPlugin('system', 'cachecleaner');
                jimport( 'joomla.html.parameter' );
                $params = new JParameter($plugin_cc->params);

                $cch = new plgSystemCacheCleanerHelper($params,'clean',0,0);
                $cch->cleanCache($params,'clean',0);
               
            }
        }

Maybe if had a way to disable the cache only in view=cart or if we could pass a param like ?time=123456789 by VM default it could fix this problem.

[WebStuff]

Okay think I've solved this. I'm using JTouch template for Mobile which doesn't honour the Joomla Cache Settings and uses it's own settings but uses the Joomla cache folder and files.
So even though I was looking at the page on a Normal Desktop it was showing me info from a cached mobile phone session from the, now in use, Joomla cache.
I have disabled the cache in JTouch and all is well again.

Sorry for the false alarm.

[Milbo]

Seems jtouch and vm does not work well together, look here http://forum.virtuemart.net/index.php?topic=116345.msg392562#msg392562