screenstaring / recharge-api Goto Github PK

Am getting the following error when trying to update the charge interval frequency on a subscription:

>> subscription.charge_interval_frequency = 1
=> 1
>> s.save
Recharge::RequestError: 400 - BAD REQUEST
	from /Users/me/.rvm/gems/ruby-2.2.3/gems/recharge-api-0.0.1/lib/recharge/http_request.rb:75:in `block in request'
	from /Users/me/.rvm/rubies/ruby-2.2.3/lib/ruby/2.2.0/net/http.rb:853:in `start'
	from /Users/me/.rvm/gems/ruby-2.2.3/gems/recharge-api-0.0.1/lib/recharge/http_request.rb:67:in `request'
	from /Users/me/.rvm/gems/ruby-2.2.3/gems/recharge-api-0.0.1/lib/recharge/http_request.rb:28:in `PUT'
	from /Users/me/.rvm/gems/ruby-2.2.3/gems/recharge-api-0.0.1/lib/recharge/http_request.rb:219:in `update'
	from /Users/me/.rvm/gems/ruby-2.2.3/gems/recharge-api-0.0.1/lib/recharge/classes.rb:216:in `save'
	from (irb):101
	from /Users/me/.rvm/rubies/ruby-2.2.3/bin/irb:15:in `<main>'

i am confused about using your rake tasks for creating hooks.

-how can i call your tasks ?

• where should i use these calls ? i cannot call them rake yourtask
  -how to pass the parameters, address and topic of hook ?

I've mentioned this previously in the Slack channel, but I'd like to flag this more publicly too. There doesn't appear to be any authentication happening for the ReCharge customer portal. So given someone's customer ID and nothing else (0-factor) I can gain full access to another customer's portal, allowing me to view personal information and even incur costs such as adding products to their subscription. This portal should be hooked in with Shopify's user authentication.

To reproduce, log in as a user to a Shopify store using ReCharge and access the customer portal. Copy the URL for this page, open a new incognito browser window and paste the URL. We can now access that user's account without ever having logged in. The customer ID is random and difficult to guess but could be easily leaked, so this is really not acceptable.

I would like to know when ReCharge intends on fixing this, as both my client and I consider this to be a serious concern.