getShopReceiptTransactionsByReceipt - returns information about any receipt_id

[robpal]

I think there should be a major bug.

/v3/application/shops/{shop_id}/receipts/{receipt_id}/transactions

Because now with this endpoint I can get information about any receipt_id on ETSY platform.

It doesn't check if receipt_id is associated with shop_id.

[Gareth064]

I no it's a bit dodgy, but can you give me a receipt ID from another shop and I can test it using my test app to see if it returns anything. I will use my shop_id wit your receipt_id

[Gareth064]

Ok first test was to make sure I couldn't get to the Order on the Web :P

I get the same error when trying to get the receipt, using my Shop_ID

{
  "ResponseCode": 404,
  "Success": false,
  "Data": null,
  "Message": "Shop_Receipt2 with PK shop_id = {shop_id} AND receipt_id = 2868329653 does not exist: ",
  "ResponseHeaders": {
    "LimitPerSecond": 10,
    "RemainingThisSecond": 9,
    "LimitPerDay": 10000,
    "RemainingToday": 9986,
    "EtsyRequestUuid": "EufuRmoPjYNTqreJcZZcNNb6VAc4"
  },
  "RequestedResource": null
}

[Gareth064]

Here are my overall Tests when using receipt_id 2868329653 and transaction_id 71185853

getShopReceipt

getShopReceiptTransactionsByReceipt

getShopReceiptTransaction

Then a bonus test using the transaction_id returned in my second test above

So the final question to ask is WHY does getShopReceiptTransactionsByReceipt return a result for a receipt_id which is not related to the shop_id?

[Gareth064]

I will email Etsy Dev support about this. But for now @nateswart just giving you a heads up about it. This seems pretty urgent as the transaction returned has all the id's of buyers, shops, etc.... and although no shipping info is present, the personalisation text could contain sensitive information

[robpal]

At least you can't get more details about buyer, shipping and etc only ID :) I could be a major data leak

[Gareth064]

100%

[nateswart]

Thank you for bringing this to our attention.