I was testing something things and looking at other issues posted on users being logged in after checkout and anonymous check. Along the way I realized there might be an issue with the way email addresses entered during checkout are checked against previous account registrations.

With Enable anonymous checkout checked as well as each of the options under Checkout Completion Settings also checked, I entered an email address during checkout that was previously registered to an account (not recently) and got this on the default checkout completion page:

"Thank you for shopping at Our store. Your current order has been attached to the account we found matching your e-mail address. ..... "

And when I check in the administrative section, this order is attached to the account that was previously registered.

I realize that there is a high probability in a production environment that the account that is found is in fact an account previously created by the same individual. But it might not be. Unless I am missing something, the way it is now, there is no check and nothing to prevent a completely different person from adding an order to a different account that is not theirs.

Aside from cases of recycled email addresses, it doesn't seem that getting into another customer's account is a particular issue if the email addresses entered is done incorrectly and happens to correspond to that of another customer. In this case, the automatic login didn't happen since an account wasn't created during this checkout.

This seems like an issue to me, and I am thinking that the check against an existing registration should happen earlier during the checkout process - and perhaps the returning customer should be prompted to log in earlier in the process.

Comments

mlncn’s picture

Priority: Normal » Critical

We are getting this problem even without existing e-mail addresses.

TR’s picture

Priority: Critical » Normal
TR’s picture