A non-profit client recently had an issue where a non-member accessed the VirtueMart area and purchased an item for sale only to members.  Access is blocked from this area by CB Subs plans and subscriptions.  Or so we thought.  After searching server access logs, I discovered this person came to the item innocently enough through a google published back door – the direct URL to the VM item, which then gave access to the cart and check-out.

Shouldn’t CB Subs prevent direct URL access to listed components?  Menu access to the VM area is restricted to registered, but as we’ve discovered, anyone can access this area.  We’ve been running CB Subs on this site for the last twelve years, and I don’t recall this ever being an issue.   What might I be missing or is this typical?

Thanks,
Ed

J 3.10.11Latest CB/CB Subs

Apparently, I was using only menu protection.  I was not able to find a way to apply ACL to VM’s individual items or categories for front-end access restriction but was successful in blocking direct URL access from within each CB Subs Plan’s component and module integration.  Tests now redirect any direct URL attempts to the registration page. 

Is this a solid fix or might there be other issues caused by this remedy?

Thanks for the poke in the right direction, Kyle!

Ed

This is a pretty standard VM application, so I don't think there are any extraneous URLs to worry about.

Thanks again!

Ed