Tickets can be hacked to buy before on-sale date

[Adam]

Hi there,

I’ve been loading my tickets into my Facebook shop. When you click on an item in Facebook shop, Facebook takes you through to your website, as well as automatically does the “add to cart” function. This happens even if an item isn’t on sale yet.

More broadly then, this would mean that if someone knows the “add to cart” code, and the ticket/product id to put into the web address, they can add the item to their cart and check out before tickets go on sale.

I’ve taken a video of what I mean, but would prefer to private message if that’s cool.

Thanks again,

Adam

[Adam]

This reply is private.

[Barry]

Hi Adam,

You’re correct: currently, the start/end sale dates really only govern the visibility of the tickets within the ticket form that appears on single event pages.

It’s possible to craft URLs that add tickets to the cart despite the fact the end sale date may have passed (or that the start sale date is still in the future) and the same thing can be done programmatically or via manual adjustments to orders.

It does seem like something we should tighten up, so I’ll log a bug report and we’ll take things from there. We will of course keep you posted and will drop an update in here once a fix is available.

[Victor]

Hi Adam!

Just wanted to share with you that a new release of our plugins is out, in which we are no longer able to reproduce the issue described here.

You can find out more about this release → https://theeventscalendar.com/maintenance-release-for-the-week-of-9-july-2018/

Please also note that we have subsequently shipped a hotfix for The Events Calendar, Events Calendar PRO and Event Tickets → https://theeventscalendar.com/announcing-the-events-calendar-4-6-20-1-events-calendar-pro-4-4-29-1-and-event-tickets-4-7-5-1/

Please update the plugins and let us know if it works for you.

Best,
Victor

[Support Droid]

Hey there! This thread has been pretty quiet for the last three weeks, so we’re going to go ahead and close it to avoid confusion with other topics. If you’re still looking for help with this, please do open a new thread, reference this one and we’d be more than happy to continue the conversation over there.

Thanks so much!
The Events Calendar Support Team

[Author]

Posts