Trashed product URL is still accessible

  • readysteadywebsites

    (@readysteadywebsites)


    4 years ago

    Great plugin, been using it for ages. But I’ve picked up an issue where a bot is hitting a trashed product and producing Stripe errors.

    They’re hitting the individual URL e.g. /?asp_action=show_pp&product_id=1234 and even though it’s in trash, it is still delivering a product that they can buy!

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Contributor Alexander C.

    (@alexanderfoxc)

    Hi and thank you for your report.

    Indeed, trashed product’s payment popup can be accessed via its direct URL. I have created a ticket in our inner system to discuss this with the team.

    As a temporary solution, you can empty products trash (or delete your trashed product permanently).

    Also, I’d recommend enabling reCaptcha in the plugin’s settings. This way bots won’t be able to do similar things on your live products.

    Plugin Contributor Alexander C.

    (@alexanderfoxc)

    This will be fixed in the upcoming plugin version. Trashed products will display error instead of payment popup when accessed via link URL.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Trashed product URL is still accessible’ is closed to new replies.