Shopify · Report #423546
H1514 Wholesale customer without checkout permission can complete purchases
Summary
The Wholesale Channel provides a configuration option to disable checkout, so that purchase orders must be reviewed by shop staff. @cablej reported that even with checkout disabled, it was possible for a customer to trigger a regular checkout flow by making a request to /purchase_orders/update_checkout. This was fixed by checking the customer permission before allowing the use of any checkout-related endpoints for purchase orders.
How it was found
Summary:
By default, Shopify Wholesale customers are prevented from immediately checking out:
{F360280}
Instead, a store admin must approve each order before the customer can pay.
This restriction can be bypassed, allowing a customer to check out orders without prior approval. This also bypasses any maximum checkout amount that a store can set.
Steps To Reproduce:
- As a Wholesale owner, ensure that a customer is disallowed from immediately checking out at https://your-store.myshopify.com/admin/apps/wholesale/admin/shops/x/accounts.
- As the customer, visit the Wholesale shop and fill your cart with products.
- Observe that the UI forces the user to submit a purchase order:
{F360285}
- To bypass this restriction, intercept the request to
PUT /purchase_orders/submitto submit the purchase order and change the url to/purchase_orders/update_checkout. - Observe that executing the request will allow the customer to proceed through the checkout flow and place the order:
{F360296}
Impact
This allows a customer to bypass manual approval restrictions for a Wholesale store and immediately check out.