0

Has anyone come across with the COUPONS field within DevDemon Forms 3.4.12 and it's security implications with regards to disclosing the codes along with the discounts within the HTML source code to the end-user?

{"DEPOSIT":{"label":"DEPOSIT 40%","code":"DEPOSIT","discount":"60%","limit":""}}

As implemented anyone would be able to see and effectively apply the discounts they want!!

If anyone here had changed the code as to 'APPLY' the COUPON and recalculate based on an AJAX request or Server Side check, please let us know!!

Regards

Improve this question

1 Answer 1

Reset to default
0

Forms coupon system is very basic and currently is not encoded. There is no security risk, but if you want to hide your deals, I recommend using something like Store instead. We will look at possibly encoding it for future versions. If this is something you need quickly, just send us an email.

Improve this answer
1
  • Thanks for your reply! Indeed we agree that the coupon system in Forms is very basic. I would let people decide whether there is a security risk or not for their application. Unfortunately for us there is not only the risk of information disclosure but the fact that anyone can apply the discount they choose!!. Even applying encoding won't solve this issue. The business logic behind a coupon system (or any discount system) should be run on the server side instead! Thanks again for your support, superb work BTW!
    – user3559
    Oct 1, 2014 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.