Ecommerce v5.1.1

Release Date: August 4, 2025
Tags: SECURITY, CRITICAL FIXES, RATE LIMITING

Upgrade Notes

• There are no breaking changes.
• Review your existing product file paths and make them relative. Digital product files are now resolved beneath a base directory set in your configuration, and a path that points outside it will no longer be served.
• Test a digital product download after updating, to confirm your files are still reachable.
• Set rate limits to suit your traffic. The shipped limits are 5 orders per 15 minutes per customer, 20 discount validations per minute and 10 downloads per hour.
• Watch the rate limit logs and adjust the thresholds if legitimate customers are being turned away.

---

Added

Rate limiting

• Added rate limiting across the ecommerce endpoints.
• Added order creation limits of 5 orders per 15 minutes per customer.
• Added discount validation limits of 20 requests per minute.
• Added download limits of 10 downloads per hour.
• Added rate limit headers to API responses, so a client can see how much of its allowance is left.
• Added an order status update that marks an order completed once it has been paid for.

---

Fixed

Path traversal in digital product downloads (CVE-PENDING)

• Fixed a path traversal vulnerability in the digital product download endpoints, which could be used to read files the customer had never bought.
• Added path sanitisation and validation to block access outside the permitted directories.
• Added a separate, restricted download route that streams the file rather than serving a path the request chose.

Price manipulation

• Added server-side price validation during order processing, so a price altered in the browser is not honoured.
• Changed checkout to re-check stock before an order completes.
• Added a product status check during checkout, so an unpublished or withdrawn product cannot be bought.
• Added quantity validation, rejecting negative and otherwise invalid amounts.

Inventory race conditions

• Fixed concurrent orders being able to oversell stock. Inventory updates now use optimistic locking and wallet operations take a database lock, so two customers buying the last item at the same moment cannot both succeed.
• Changed order processing to complete atomically, and to roll back cleanly on failure rather than leaving an order half-written.