Why oh why Does this keep happening?

We thought by changing the Sessions configuration to be TRUE to recreate a session each new user that we would not have the issues we were having with a user logging in as someone else in their session. NOW we've had some times we noticed that we were getting confirmations from the same person for the same free items right after each other, but thought it might just be a zen id problem, where the original customer had given out the link with the zen id in it.

It doesn't seem to be solved yet. We just had a customer ask us about all the confirmations she is getting when she didn't even check out of the store at all. Someone was even able to purchase items logged in as her! They used their own paypal address and password to check out.

We asked her and she did not give out a link to the store while she was logged in.

This is VERY frustrating. Does ANYone have any idea what is going on? Or better yet, how to fix it?

What version of Zen Cart are you using?

|
I think it's 2.5.

Copyright (c) 2004 The zen-cart developers |
// | |
// | http://www.zen-cart.com/index.php |
// | |
// | Portions Copyright (c) 2003 osCommerce |
// +----------------------------------------------------------------------+
// | This source file is subject to version 2.0 of the GPL license, |
// | that is bundled with this package in the file LICENSE, and is |
// | available through the world-wide-web at the following url: |
// | http://www.zen-cart.com/license/2_0.txt. |
// | If you did not receive a copy of the zen-cart license and are unable |
// | to obtain it through the world-wide-web, please send a note to |
// | [email protected] so we can mail you a copy immediately. |
// +----------------------------------------------------------------------+
// $Id: version.php 1032 2005-03-17 07:11:04Z drbyte $
//

// Define the project version
define('PROJECT_VERSION_NAME', 'Zen Cart');
define('PROJECT_VERSION_MAJOR', '1');
define('PROJECT_VERSION_MINOR', '2.5');
define('PROJECT_VERSION_PATCH_MAJOR', '');
define('PROJECT_VERSION_PATCH_MINOR', '');

This often happens because during the startup or testing phase of a new website it has been run with 'Prevent Spider Sessions' set to false in the admin panel. Sarch engines spider the site, create session ids, and then include those ids in search engine links. Different people come to your website all with the same session id - they end up in each others carts and accounts.

Long term this will filter out for new customers as search engines spider the site but don't create session ids (with Prevent Spider Sessions set to true).

Where you encounter this with existing customers you may just have to advise the affected people to delete any bookmarks they have created, and one of the two affected customer accounts may have to be deleted and recreated.

Vger

Thank you for letting me know this. I don't know if this is what happened with our site, but it makes a lot of sense.

A related question, if we change the sessions configuration true for "Check IP address", will that help prevent someone from using someone else's zen id?

No, because people often use different IP addresses when they connect to your site e.g. dial-up customers and USB adsl customers with variable ip addresses. It's only people with static ip addresses for their adsl connections that will use the same ip address - and there's also no connection between ip address and session id.

Vger

The recreate session did NOT function properly in v1.2.5, you really need to upgrade to take advantage of the improved session handling and security of v1.3.0.2

you can also look in the application_top.php file and change the instance of zenid to something else,
its defined 2 times if Im not mistaken