You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello! I think there is a flaw in ProductRetrieveView when looking for a product. The product search does not include the current CMS page. As a result, the product can be opened by a link that contains someone else's category. For example, we have an apple product and it is in the fruits category and is located under the /fruits/apple link. But because of this flaw, it can be opened for another existing category of vegetables: /vegetables/apple. This is because there is no filtering on the current CMS page in the product queryset here:
Hello! I think there is a flaw in ProductRetrieveView when looking for a product. The product search does not include the current CMS page. As a result, the product can be opened by a link that contains someone else's category. For example, we have an apple product and it is in the fruits category and is located under the
/fruits/apple
link. But because of this flaw, it can be opened for another existing category of vegetables:/vegetables/apple
. This is because there is no filtering on the current CMS page in the product queryset here:django-shop/shop/views/catalog.py
Lines 310 to 321 in 13d9a77
How about add to ProductRetrieveView ability support of backend filters like CMSPagesFilterBackend?:
The text was updated successfully, but these errors were encountered: