spree/spree — Issue #1243: CanCan Incorrect Abilities - Allows View of Other's Orders
Author: simonmorley
Created: 2012-03-07 21:18:54+00:00
State: open

Using Spree 1.1.0.beta, Rails 3.2.2.

I think this is a bug. I can view the contents of other user's orders if I'm logged in as any user.

1. Create new order as user 1.
2. Logout
3. Create new user account
4. Navigate to order and contents, address, details show.

Url isn't encrypted despite using ssl. Poses a significant issue. Logs don't show any errors.

If I try and view order when not logged in, I get:

CanCan::AccessDenied (You are not authorized to access this page.):

Try is on our shop if you need to with dummy order:

http://polkashop.polkaspots.com/orders/R454116632