Prestashop: Return page should not be avalaible if returns is disabled

[clotairelims]

Describe the bug

You could access to the return page in front office even if this feature is not enable.

Expected behavior

Return page should not be avalaible if Enable returns is set to no

Steps to Reproduce

Steps to reproduce the behavior:

1. Go to BO Customer Service > Merchandise Returns
2. Set "enable return " to "no"
3. Go to https://yourshop.tld/index.php?controller=orderfollow

This page should return a 404 error.

Screenshots

Additional information

• PrestaShop version: 1.7.6.5 1.7.7.0
• PHP version: N/A

[prestashop-issue-bot[bot]]

Thanks for opening this issue! We will help you to keep its state consistent

[LouiseBonnard]

Hello @clotaire202, thank you for this improvement idea! Let's wait for a PM to study it. :-)

[clotairelims]

It's a security issue too.

[LouiseBonnard]

Okay, thanks @clotaire202, perhaps I should classify this issue as a critical bug then? @PrestaShop/prestashop-core-developers, could you please have a look at it?

[jolelievre]

@LouiseBonnard indeed a it's a bug that needs to be fixed, I'm not sure it's this complicated either Ideally it just requires to check the feature is enable in a controller and redirect to a 404 if needed

@clotaire202 I'm not sure there is such a threat from a security point of view since user shouldn't be able to access critical information anyway, but maybe I'm minimizing the problem

If there's a security threat it should be fixed in 1.7.7, else it will be fixed in 1.7.8 @PierreRambaud what's you opinion regarding the security problem?

[clotairelims]

We are agree that there is an issue and that's probably not critical. Access to a none authorized page without possibility to exploit something... We wait for the security guru to know the severity level.

I've just added the PR to fix it in case it should be fixed quickly.

[Progi1984]

@PierreRambaud If it's ok for you, the PR can go to the QA Hands ;)

[PierreRambaud]

This one needs to target the 1.7.7.x branch. As it says, seeing an unauthorized page is a security issue. Even if it's minor.

[Progi1984]

Thanks @PierreRambaud

[Progi1984]

Fixed by #19395