Home » Forums » Ubercart » Ideas and Suggestions

Why unset($_SESSION['cart_order']) at 'cart'?

Submitted by michels on Tue, 02/05/2008 - 12:04
michels

Posts: 82
 Joined: 08/12/2007
Uber DonorBug FinderInternationalizationizer

Hi.

I just thought about this because of usability-reasons.

When I do a checkout, enter my personal data, go to the review page and see, that I added a wrong product - I go back to the Cart, make the changes.. Then I click once again on checkout - And I must enter my hole data again.

I don't like this, cause it's not very userfriendly.

So I made some changes in uc_cart.module (uc_cart_view() and uc_cart_checkout_form()) and it now works as I expected - After entering the data once they are available also when I go back to the cart.

But in ~line 1430 uc_cart.module you've made the following comment:
// Check the referer URI to clear the order details and prevent identity theft.

So my question is: Why could there be identity theft? And do you really recommend, not to do such a modification?

--

Legal aspects pane for european shops
AGB und Widerrufsrecht im Bestellprozess einblenden
permalink #1 Tue, 02/05/2008 - 12:33
Ryan

Posts: 5379
 Joined: 08/07/2007
AdministratorHead Code Monkey - I eat bugs.

My main thought here is that if someone were to fill out all their contact information but then cancel the order or browse away, I don't want to retain the data longer than I have to. If they were browsing on a public computer (not recommended for shopping, but people do it), someone who comes after them could just go right on in and see all their information. Unsetting the cart_order "resets" the form when someone comes behind that user.

So, I'm not hard and fast that this has to happen, but it seemed like the thing to do at the time.

permalink #2 Tue, 02/05/2008 - 15:47
michels

Posts: 82
 Joined: 08/12/2007
Uber DonorBug FinderInternationalizationizer

Alright, security vs usability.

I will think about this.
One alternative could be to set the session.cookie_lifetime = 0, so that the session-cookie is destroyed after closing the browser.

--

Legal aspects pane for european shops
AGB und Widerrufsrecht im Bestellprozess einblenden