php · craftcms/commerceHeads-up
craftcms/commerce: Unconditional Rate Limiting for Coupon Submissions
The CartController's RateLimiter is only activated when the 'number' parameter is provided, leaving the session-based cart without rate limiting for coupon code
What changed
The CartController's RateLimiter is only activated when the 'number' parameter is provided, leaving the session-based cart without rate limiting for coupon code submissions.
Who it affects
All Craft Commerce installations using coupon codes on session-based carts.
What to do today
Apply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.
The trail
Collected→
Audited→
Written→
Published