woothemes/woocommerce — pull request #3741 by ragulka (2013-09-06 14:54:48+00:00)
Title: Frontend security improvements

This pull request addresses a few frontend security concerns and allows plugin and theme authors to override the security checks to implement custom security behaviors.

The following changes were made:

1. Add `wc_print_messages()` to `cart-empty.php`. This is a small convenience improvement. Sometimes there is a messages queued to be displayed, but the user is redirected to his cart page. When cart was empty, the message would not have been displayed. The first commit addresses this issue.
2. Add security checks for `cancel_order` and `pay_for_order` actions. Up until now, if a user somehow had access to the order ID and wpnonce, he could have canceled someone else's order. The same goes for paying for an order.
3. Replace hardcoded security checks (`$order->user_id != $user_id`) with `current_user_can` checks to allow plugin and theme authors implement custom security checks/routines. For example, see https://github.com/ragulka/woocommerce/compare/security-improvements?expand=1#L0R359. The default implementation still checks the current user ID against $order->user_id, but now it can be overriden by adding a filter to `user_has_cap`. A use-case for this would be if a shop owner wants to let certain users view each other's orders, for ex. in a B2B e-commerce site.
4. Provide default security checks by adding a filter to `user_has_cap`.