Random user can check another user's order with the correct channelId and accountId - Headless API
Written By
Solyom Nagy-Györkös
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
Legacy Article
You are viewing an article from our legacy "FastTrack"
publication program, made available for informational purposes. Articles
in this program were published without a requirement for independent
editing or verification and are provided"as is" without
guarantee.
Before using any information from this article, independently verify its
suitability for your situation and project.
Issue
- User can consume the API without applying any sort of content restriction or authorization
/o/headless-commerce-delivery-order/v1.0/channels/${channelId}/accounts/${accountNumber}/placed-orders
- E.g.: If the user passes accountID = 1 as a parameter while they authenticated using accountID = 2, the API call will accept the request and the user can see the details and response for accountID 1
Resolution
- When a user is assigned View Open Orders, View Orders through an Account Role, i.e. Buyer, the user is only able to view placed orders specific to the account they have the buyer role assigned to when consuming: v1.0/channels/${channelId}/accounts/${accountNumber}/placed-orders
Did this article resolve your issue ?