[5.x]: Sharing Cart with a credentialed Customer

[samuelbirch]

What happened?

Description

When sharing a cart or loading a cart via a plugin (abandoned cart functionality) if the cart has a credentialed customer then it will not load if the customer is not already logged in. Not a great UX if the customer is clicking a link in an abandoned cart email and they get an empty cart.

Craft CMS version

5.8.23

Craft Commerce version

5.5.2

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[linear]

COM-526

[lukeholder]

@samuelbirch this should be fixed with #4207, which will be included in Commerce 4.11 and 5.6 - since the cart load controller action will require a new token which will be added automatically to the load link on the order.

Not allowing the credentialed cart to load for anonymous users was a information disclosure security issue since in theory the cart number is guessable. The token and email recovery options will solve that.

I will leave this ticket open and update you here once the release is out.

Let me know if you have any questions about the PR/feature.

[samuelbirch]

Thanks @lukeholder

[denisyilmaz]

@lukeholder is this shipped in Commerce 5.6 already?

[lukeholder]

@lukeholder is this shipped in Commerce 5.6 already?

This will be in 5.7 out in the next couple of weeks.

Thanks!

[samuelbirch]

@lukeholder Has this been shipped in 5.7?

[lukeholder]

Sorry! There was a bug in 5.7 for this.

I have fixed it for the next release.

To get the fix early, change your craftcms/commerce requirement in composer.json to:

"require": {
  "craftcms/commerce": "5.x-dev#8c94955fca834b218bddf3aaea8753de6bd92385 as 5.7.0",
  "...": "..."
}

Then run composer update.

We will update this ticket once the release is out.

[nfourtythree]

Commerce 5.7.1 has now been released with this fix included.

Thanks!