Vendors able to see all orders on marketplace

  • Hi Team,

    I am integrating my WooCommerce website with a third party shipping service called ShipRocket.
    When individual WCFM vendors with their own shiprocket account integrate with my WooCommerce website, they are able to see all the orders on the marketplace and edit them as well.
    The vendors use their own email and password to authenticate with woocommmerce while integrating.
    This seems to be a major security flaw, please suggest on what can be done on the role management of vendors?

Viewing 15 replies - 1 through 15 (of 18 total)
  • Plugin Author WC Lovers

    (@wclovers)

    When individual WCFM vendors with their own shiprocket account integrate with my WooCommerce website, they are able to see all the orders on the marketplace and edit them as well.

    – How this? WCFM does not provide any integration with this shipping service.

    Are you allowing vendors to access site’s “wp-admin” area?

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi,

    I have turned off vendor access to admin backend from frontend capability side.

    WooCommerce provides integration to this shipping service.
    This is what happens:

    1.Vendor logs into his own ShipRocket
    2. Clicks on integrate with WooCommerce.
    3. Enter my marketplace website in the option
    4. Redirect to WooCommerce authentication page , vendor will log into his WooCommerce account(registered through wcfm).
    5. Integration complete.

    In theory vendor should only be able to see his own orders but can see all the orders on the marketplace.

    • This reply was modified 4 years, 7 months ago by bohrabiz.
    Plugin Author WC Lovers

    (@wclovers)

    Redirect to WooCommerce authentication page , vendor will log into his WooCommerce account(registered through wcfm).

    – But how many vendors are authenticating on same site?

    Does that plugin support multiple users’ integration same site?

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi Team,

    As of now , I have tried with 3 test vendor accounts and all of them were able to authenticate via the plugin.
    There does not seem to be a limit as they are all separate accounts

    Plugin Author WC Lovers

    (@wclovers)

    Umm .. please check in depth. I think it only keeping last authenticated vendor.

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi ,

    I am able to see the WooCommerce rest api activity and all 3 users (vendors) are given read/write access through the api.
    So I am sure all of them are able to integrate with the website.
    The main concern is the role assignment (Store Vendor) making them able to see all the orders in the shiprocket plugin and edit them as well.

    Thread Starter bohrabiz

    (@bohrabiz)

    Any response?

    Plugin Author WC Lovers

    (@wclovers)

    The main concern is the role assignment (Store Vendor) making them able to see all the orders in the shiprocket plugin and edit them as well.

    – Exactly where? Show me a screenshot please.

    If you are not able to attach then upload your images here and share with us – https://imgbb.com/

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi Team,

    Please find the screenshot in the below link.

    https://ibb.co/s6PFrJx
    https://ibb.co/9nCCX7K

    In the screenshot are two separate vendors on my marketplace. Only one vendor (Jaipuri Tales) should be able to see the order as it is their product but even respawn crate can see it too.
    Note that both of these accounts are “Store Vendors” with no modifications to their roles.

    This is the only thing blocking me from purchasing the lifetime license for your software. Hope it can be resolved

    Plugin Author WC Lovers

    (@wclovers)

    Thanks for the screenshots.

    Hopefully you are using a third party plugin for “Shiprocket” integration. (Which plugin?)

    Now the problem is this plugin does not support multi vendor so when it’s syncing orders with shiprocket applying on full order, not filter items for vendors.

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi Team,

    ShipRocket does not have a packaged plugin but just an integration option in the account dashboard.

    Plugin Author WC Lovers

    (@wclovers)

    OK, but how it’s fetching orders from WooCommerce ?

    Thread Starter bohrabiz

    (@bohrabiz)

    Hi Team,

    Please take a look at this screenshot in the ShipRocket Integration page:

    Step 1:
    https://ibb.co/vZ5G5yv
    Step 2:
    https://ibb.co/L5Zj9Rg

    Thanks~

    Plugin Author WC Lovers

    (@wclovers)

    OK.

    This integration will not work for multi vendor site.

    It’s fetching all WooCommerce orders.

    So for a vendor it will fetch all orders from all vendors.

    Thread Starter bohrabiz

    (@bohrabiz)

    Is there any other plugin or shipping service that you integrate with?

Viewing 15 replies - 1 through 15 (of 18 total)
  • The topic ‘Vendors able to see all orders on marketplace’ is closed to new replies.