Answers.Body: <p>As a rule in Commerce, when retrieving orders on client side templates, you should limit the retrieved orders to orders for the current customer only, using the <code>customer</code> parameter:</p>
  
  <pre class="lang-twig prettyprint-override"><code>{% set number = craft.request.param('number') %}
  {% set order = craft.commerce.orders.number(number).customer(craft.commerce.customer).first() %}
  {% if not order %}
      {% redirect 'login' %}  {# or wherever #}
  {% endif %}
  </code></pre>
  
  <p>(...if the included example templates aren't doing that, you should let Luke know.  I haven't looked at them in ages and don't have them to hand here...)</p>
  
  <p>(One slightly random side thing I have noted with time is that you should really limit loading of the order complete page to a single time, i.e. only specifically at the actual order completion - if you don't, you tend to get issues with re-submissions of orders to your analytics and so forth.  E.g. if the customer completes an order, goes somewhere on the site, then comes back to the complete page using the back button - it can create issues - so I remove the number parameter from the url using some JS and make sure I check for a number in the url in the <code>cart/complete</code> template:</p>
  
  <pre class="lang-twig prettyprint-override"><code>{# Show empty cart if they somehow get back here without a number.... #}
  {% set number = craft.request.param('number') %}
  {% if not number %}
      {% redirect 'cart' %}
  {% endif %}
  </code></pre>
  
  <p>And the JS would be something like:</p>
  
  <pre class="lang-js prettyprint-override"><code>if(window.location.pathname == "cart/complete"){
      var cleanedUrl = utilities.removeURLParameter(window.location.href, "number");
      window.history.pushState('',document.title,cleanedUrl);
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-19T02:54:03.527Z
Answers.Text: Perfect. Works great. The original templates have the code I originally posted. Perhaps they've been updated since. I'll shoot them a message to check.
Answers.UserDisplayName: Wonko
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-18T22:19:06.780Z
Answers.LastActivityDate: 2017-11-18T22:19:06.780Z
Answers.UserDisplayName: Jeremy Daalder
Body: <p>If anyone visits <a href="http://site.com/commerce/customer/order" rel="nofollow noreferrer">http://site.com/commerce/customer/order</a> they see the last order made even if they are not logged in and not related to that order in any way.</p>
  
  <p>The customer can see their order info if they use <a href="http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder" rel="nofollow noreferrer">http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder</a>. Stripping the ? and the random string after it shows the last order.</p>
  
  <p>I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:</p>
  
  <pre><code>{% extends '_layout' %}
  {% set number = craft.request.param('number') %}
  {% set order = craft.commerce.orders.number(number).first() %}
  {% if not order %}
      {% redirect 'commerce/customer' %}
  {% endif %}
  </code></pre>
  
  <p>So it does not seem to be redirecting to commerce/customer.</p>
  
  <p>Any help would be great.</p>
  
Tags: <plugin-craftcommerce>
Title: Customer details revealed at base order URL
ThreadText: # Customer details revealed at base order URL
  
  (Asked by: username_0 on 2017-11-18)
  
  If anyone visits <http://site.com/commerce/customer/order> they see the last order made even if they are not logged in and not related to that order in any way.
  
  The customer can see their order info if they use <http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder>. Stripping the ? and the random string after it shows the last order.
  
  I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:
  
  ```
  {% extends '_layout' %}
  {% set number = craft.request.param('number') %}
  {% set order = craft.commerce.orders.number(number).first() %}
  {% if not order %}
      {% redirect 'commerce/customer' %}
  {% endif %}
  
  ```
  
  So it does not seem to be redirecting to commerce/customer.
  
  Any help would be great.
  
  **Tags:** plugin-craftcommerce
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-11-18. Score: 1 | Accepted answer
  
  As a rule in Commerce, when retrieving orders on client side templates, you should limit the retrieved orders to orders for the current customer only, using the `customer` parameter:
  
  ```twig
  {% set number = craft.request.param('number') %}
  {% set order = craft.commerce.orders.number(number).customer(craft.commerce.customer).first() %}
  {% if not order %}
      {% redirect 'login' %}  {# or wherever #}
  {% endif %}
  
  ```
  
  (...if the included example templates aren't doing that, you should let Luke know. I haven't looked at them in ages and don't have them to hand here...)
  
  (One slightly random side thing I have noted with time is that you should really limit loading of the order complete page to a single time, i.e. only specifically at the actual order completion - if you don't, you tend to get issues with re-submissions of orders to your analytics and so forth. E.g. if the customer completes an order, goes somewhere on the site, then comes back to the complete page using the back button - it can create issues - so I remove the number parameter from the url using some JS and make sure I check for a number in the url in the `cart/complete` template:
  
  ```twig
  {# Show empty cart if they somehow get back here without a number.... #}
  {% set number = craft.request.param('number') %}
  {% if not number %}
      {% redirect 'cart' %}
  {% endif %}
  
  ```
  
  And the JS would be something like:
  
  ```js
  if(window.location.pathname == "cart/complete"){
      var cleanedUrl = utilities.removeURLParameter(window.location.href, "number");
      window.history.pushState('',document.title,cleanedUrl);
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Perfect. Works great. The original templates have the code I originally posted. Perhaps they've been updated since. I'll shoot them a message to check.  
  
  ---
  
  