Wootickets allows users to purchase tixs without the password for Private Events

[Mike]

I found a flaw in your ticketing. When an event is set to private, the ticketing form shows up below the password fold, thus allowing users to purchase tickets without having the private event’s password. This is a major security flaw for private events, as it would allow unauthorized users to purchase tickets and skip the password authorization.

[Barry]

Hi Mike,

Thanks for reporting that: a fairly straightforward solution is to find the code at the start of the tickets.php template:

<?php global $woocommerce; ?>

And change it to:

<?php
global $woocommerce;
if (post_password_required()) return;
?>

Remember that this would ideally be handled within a template override (a copy of tickets.php contained within an events directory inside your theme) – you can read more on that in our themer’s guide and we have a specific tutorial covering template overrides.

So hopefully that offers you an interim solution, meanwhile I’ll talk to the team and see what we can do here.

[Barry]

Some further improvements with regards to private event posts are coming in The Events Calendar 3.0. For the time being though I will close this thread.

[Author]

Posts