[5.x]: Sharing Cart with a credentialed Customer

[samuelbirch]

What happened?

Description

When sharing a cart or loading a cart via a plugin (abandoned cart functionality) if the cart has a credentialed customer then it will not load if the customer is not already logged in. Not a great UX if the customer is clicking a link in an abandoned cart email and they get an empty cart.

Craft CMS version

5.8.23

Craft Commerce version

5.5.2

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[linear]

COM-526

[lukeholder]

@samuelbirch this should be fixed with #4207, which will be included in Commerce 4.11 and 5.6 - since the cart load controller action will require a new token which will be added automatically to the load link on the order.

Not allowing the credentialed cart to load for anonymous users was a information disclosure security issue since in theory the cart number is guessable. The token and email recovery options will solve that.

I will leave this ticket open and update you here once the release is out.

Let me know if you have any questions about the PR/feature.

[samuelbirch]

Thanks @lukeholder