Netpoint 5.96 Catalog security problem - Anyone can see other users catalog

Question

I just had a revelation regarding the security of the catalogs.
Anyone wise enough to realize that adding ?Category=x on the address can access the catalogs of any other customers !!!!! BIG BIG PROBLEM
I will soon test if they also get the price list of that other catalog ?
Is there a way to prevent a user from SEEING other catalogs ?

Answer 1

Hi Shane,
thanks for that, it worked nicely.
For anyone watching this thread, he're my effort at securing the shipment.aspx page.
It is an ascx control with no visual components, that you should drop in right at the very top of the page:
<%@ Control Language="C#" ClassName="SBPageSecurity" %>
<%@ Import Namespace = "netpoint.classes" %>
<%@ Import Namespace = "netpoint.api.catalog" %>
<%@ Import Namespace = "netpoint.api" %>
<%@ Import Namespace = "netpoint.api.commerce" %>
<script runat="server">
    protected void Page_Load(object sender, EventArgs e)
       string connString =  ConfigurationSettings.AppSettings["connString"].ToString();
       NPSession s = new NPSession(this.Context, connString);
       //verify that the logged-in accountId matches the Shipment object AccountID
       int docnum = (Request["shipmentid"] == null ? 0 : Convert.ToInt32(Request["shipmentid"]));
       if (0 == docnum)
           //no doc num
           Response.End();
       else
           NPShipment shipment = new NPShipment(docnum);
           if (shipment.AccountID != s.AccountID)
               Response.End();
</script>
So basically all it does is verify that the logged in Account "owns" the document they are trying to view.
I'm sure there is room for improvement, but at least it may be a place to start for some folks.
Regards,
Steve