URGENT: Privacy Breach – Guest Booking Form

Hi Solidres Team,
We have identified an urgent potential privacy breach affecting the Guest Information step of the reservation process in Solidres 4.4.0.

When an unauthenticated visitor selects accommodation and dates, then proceeds to the Guest Information form, the fields are automatically populated with another customer's personal information, including their full name, residential address and telephone number.

Privacy risk: Personal information associated with an existing reservation is being disclosed during unrelated booking attempts, without authentication or authorisation. The information is visible before a booking is submitted and without the visitor entering any personal details.

Issue reproduction

• Occurs across all accommodation types and different booking dates.
• Reproduced on two separate computers, including fresh Chrome Incognito sessions.
• The same existing customer's details appear consistently.
• Both computers were on the same network; independent external-network testing has not yet been completed.
• The affected customer has a legitimate existing reservation.

Technical findings
1. Server response

• Affected request:
  Code:

  reservation.progress
  (Guest Information step).
• The returned HTML already contains the customer's personal information in the form field values.
• Browser autofill has therefore been ruled out.
• Response includes
  Code:

  Cache-Control: public, max-age=0,public
  .

2. Solidres code inspection

• Code:

  ReservationBaseController.php
  : Confirmed
  Code:

  getHtmlGuestInfo()
  calls the reservation model's
  Code:

  getBookForm()
  method.
• Code:

  ReservationModel.php
  : Confirmed guest information is retrieved from reservation data and Joomla session state.
• Code:

  guestform.php
  : Confirmed form fields are populated from
  Code:

  $reservationDetails->guest
  .

3. Session configuration

• Session Handler: Database
• Shared Sessions: Disabled
• Session Lifetime: 600 minutes

4. Caching investigation

• Browser cache cleared and disabled during testing.
• Joomla Conservative Cache cleared without resolving the issue.
• System – Page Cache plugin: Disabled.
• JCH Optimize plugin: Disabled.
• LiteSpeed cache management and
  Code:

  .htaccess
  directives inspected.
• Existing
  Code:

  .htaccess
  rules include
  Code:

  Header append Cache-Control "public"
  .

5. Changes made

• No Solidres core files or existing reservations have been modified.
• No server caching configuration has been changed.

We have not established whether the cause is session handling, server-side caching or another mechanism.

Could the Solidres development team urgently advise on the likely cause, recommended resolution and immediate measures to prevent further unauthorised disclosure of customer information?

Given the potential exposure of personally identifiable information, we consider this a security-sensitive issue requiring priority attention.

Further technical details and supporting evidence can be provided privately rather than disclosed on this public forum.

**Edit: We updated to Solidres 4.6.0 and updated all plugins. We also removed the booking from the system, cleared the cache and the details are still showing when making a new booking.

Thank you.

Hi Karim,

Thank you for the detailed report. Your troubleshooting narrowed this down a lot.

We think we know the cause, and it isn't your cache. When a visitor who is not logged in reaches the Guest Information step, Solidres looks for a customer record linked to the visitor's Joomla user id. A guest's id is 0. If your customers table has a record whose user id is 0, which can happen with data carried over from an older site or an import, that record's details are prefilled for every guest. That would explain why the same details appear for any room, date and browser, why clearing caches and deleting the booking didn't help, and why the email field stays empty.

To confirm, please:

1. Run this read-only query in phpMyAdmin (replace xxx_ with your table prefix). It changes nothing:

SELECT id, user_id, firstname, lastname, city FROM xxx_sr_customers WHERE user_id = 0;

2. Tell us whether the prefilled details are always the same person, or change to whoever booked most recently.

Please don't post the results here, since they contain a customer's personal data. Open a private support ticket instead and include the query results and your answer to question 2. We'll reply there with the exact cleanup steps for your site. Please don't delete anything in Solidres → Customers in the meantime: deleting a customer there also removes data attached to that customer's reservations.

Either way, we're fixing Solidres so it never looks up a customer record for a visitor who isn't logged in. The fix will be in the next release.

Separately, we recommend removing the Header append Cache-Control "public" line from your .htaccess, or at least excluding Solidres requests from it. It allows proxies and server caches to store pages that contain personal data.

Best regards,