Extbase · Question 11 of 12
A shop plugin shows orders with showAction(Order $order). Fluid builds the link with the uid. Which corrections close the IDOR hole?
2 answers are correct. Hard
Show answer
Answer
- A Throw a 403 response for a foreign order instead of showing it
- C Check in the controller whether the order belongs to the logged-in user
Explanation
Extbase loads the object via the identity. Without an ownership check, everyone sees every order. Hiding or enlarging the ID changes nothing about the missing check.