A security release: seven fixes close off marketplace data that the wrong account could reach, across support tickets, verification, payouts, shipping, and staff.
Datenschutz und Sicherheit
- Fix: Hardened Store Support so a ticket can only reference the customer’s own orders from that vendor.
- Fix: Patched a SQL injection vulnerability in vendor verification request sorting by accepting only ascending or descending order.
- Fix: Patched a PHP object injection vulnerability in product attributes meta when vendors save or open a product.
- Fix: Hardened MangoPay payout bank accounts so they can only be viewed or changed by their rightful owner.
- Fix: Stopped unpublished and deleted Product Q&A entries from appearing on the public REST endpoint.
- Fix: Hardened Distance Rate Shipping so vendors can only view their own settings.
- Fix: Patched a cross-site scripting vulnerability in the staff ID on the Vendor Staff edit form.
English 
العربية 
Français 
Español 
Deutsch