3 replies to this topic

[plazman65]

Last week I had a customer log into another account but they used their own paypal account to make a purchase. I emailed the customer that had "logged" into the others account but never heard back. We thought it was strange since she used her own paypal to make a purchase.
Well today the customer that had her account hacked or logged into went to the website and it said she was logged in but was actually already logged in as someone else entirely, she had access to a different customers orders. I am running a older version 2.2 rc2
Im not sure where to even look for a solution? Thanks for anyhelp you can provide

[germ]

Sounds like the site has been indexed with session ID's attached.

In your admin set:

Prevent Spider Sessions True
Recreate Session True

[germ]

And update your spiders.txt file, link to contribution here

[plazman65]

Thank you so much for the reply!