Impact: minor
Type: bugfix

Issue

• "accounts/addressBookRemove" Meteor method did not correctly check permissions on multi-shop installations. By having "reaction-accounts" permission on any shop, you could update accounts belonging to any other shop.
• "accounts/addressBookUpdate" Meteor method did not correctly check permissions on multi-shop installations. By having "reaction-accounts" permission on any shop, you could update accounts belonging to any other shop.
• "accounts/sendWelcomeEmail" Meteor method did not check permissions. Any user (possibly even someone who isn't logged in) who knows a MongoDB shop ID and account ID could cause a welcome email to be sent to that account's email address.

Solution

• Added account.shopId to permission check in "accounts/addressBookRemove"
• Added account.shopId to permission check in "accounts/addressBookUpdate"
• Removed the "accounts/sendWelcomeEmail" Meteor method and instead put the same code in an internal sendWelcomeEmail util function that is only callable from server code.

Breaking changes

Custom code relying on being able to call the "accounts/sendWelcomeEmail" Meteor method will break. Calls from client code must be removed. Calls from server code should be updated to import and call the util function.

Testing

1. Verify that the described permission issues are fixed.
2. Verify that you can still change your own address and remove an address from your address book.
3. Verify that a welcome email is sent when you register a new user.