<p>As a rule in Commerce, when retrieving orders on client side templates, you should limit the retrieved orders to orders for the current customer only, using the <code>customer</code> parameter:</p>

<pre class="lang-twig prettyprint-override"><code>{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).customer(craft.commerce.customer).first() %}
{% if not order %}
    {% redirect 'login' %}  {# or wherever #}
{% endif %}
</code></pre>

<p>(...if the included example templates aren't doing that, you should let Luke know.  I haven't looked at them in ages and don't have them to hand here...)</p>

<p>(One slightly random side thing I have noted with time is that you should really limit loading of the order complete page to a single time, i.e. only specifically at the actual order completion - if you don't, you tend to get issues with re-submissions of orders to your analytics and so forth.  E.g. if the customer completes an order, goes somewhere on the site, then comes back to the complete page using the back button - it can create issues - so I remove the number parameter from the url using some JS and make sure I check for a number in the url in the <code>cart/complete</code> template:</p>

<pre class="lang-twig prettyprint-override"><code>{# Show empty cart if they somehow get back here without a number.... #}
{% set number = craft.request.param('number') %}
{% if not number %}
    {% redirect 'cart' %}
{% endif %}
</code></pre>

<p>And the JS would be something like:</p>

<pre class="lang-js prettyprint-override"><code>if(window.location.pathname == "cart/complete"){
    var cleanedUrl = utilities.removeURLParameter(window.location.href, "number");
    window.history.pushState('',document.title,cleanedUrl);
}
</code></pre>

CC BY-SA 3.0
2017-11-19T02:54:03.527Z
Perfect. Works great. The original templates have the code I originally posted. Perhaps they've been updated since. I'll shoot them a message to check.
Wonko
CC BY-SA 3.0
2017-11-18T22:19:06.780Z
2017-11-18T22:19:06.780Z
Jeremy Daalder
<p>If anyone visits <a href="http://site.com/commerce/customer/order" rel="nofollow noreferrer">http://site.com/commerce/customer/order</a> they see the last order made even if they are not logged in and not related to that order in any way.</p>

<p>The customer can see their order info if they use <a href="http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder" rel="nofollow noreferrer">http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder</a>. Stripping the ? and the random string after it shows the last order.</p>

<p>I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:</p>

<pre><code>{% extends '_layout' %}
{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).first() %}
{% if not order %}
    {% redirect 'commerce/customer' %}
{% endif %}
</code></pre>

<p>So it does not seem to be redirecting to commerce/customer.</p>

<p>Any help would be great.</p>

<plugin-craftcommerce>
Customer details revealed at base order URL
# Customer details revealed at base order URL

(Asked by: username_0 on 2017-11-18)

If anyone visits http://site.com/commerce/customer/order they see the last order made even if they are not logged in and not related to that order in any way.
The customer can see their order info if they use http://site.com/commerce/customer/order?randomcustomerorderstringforthatspecificorder. Stripping the ? and the random string after it shows the last order.
I am using the standard template to display order information. They are redirected to this page after they complete a transaction. Relevant code is:
{% extends '_layout' %}
{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).first() %}
{% if not order %}
    {% redirect 'commerce/customer' %}
{% endif %}

So it does not seem to be redirecting to commerce/customer.
Any help would be great.

**Tags:** plugin-craftcommerce


---

## 1 answers

### Answer by username_1 on 2017-11-18. Score: 1 | Accepted answer

As a rule in Commerce, when retrieving orders on client side templates, you should limit the retrieved orders to orders for the current customer only, using the customer parameter:
{% set number = craft.request.param('number') %}
{% set order = craft.commerce.orders.number(number).customer(craft.commerce.customer).first() %}
{% if not order %}
    {% redirect 'login' %}  {# or wherever #}
{% endif %}

(...if the included example templates aren't doing that, you should let Luke know.  I haven't looked at them in ages and don't have them to hand here...)
(One slightly random side thing I have noted with time is that you should really limit loading of the order complete page to a single time, i.e. only specifically at the actual order completion - if you don't, you tend to get issues with re-submissions of orders to your analytics and so forth.  E.g. if the customer completes an order, goes somewhere on the site, then comes back to the complete page using the back button - it can create issues - so I remove the number parameter from the url using some JS and make sure I check for a number in the url in the cart/complete template:
{# Show empty cart if they somehow get back here without a number.... #}
{% set number = craft.request.param('number') %}
{% if not number %}
    {% redirect 'cart' %}
{% endif %}

And the JS would be something like:
if(window.location.pathname == "cart/complete"){
    var cleanedUrl = utilities.removeURLParameter(window.location.href, "number");
    window.history.pushState('',document.title,cleanedUrl);
}

> **Comments:**
> **username_0**: Perfect. Works great. The original templates have the code I originally posted. Perhaps they've been updated since. I'll shoot them a message to check.  

---

