Security: Disallow querying of personal data for guest Customers

[michaelbromley]

Currently it is possible to:

1. Use setCustomerForOrder with [email protected]
2. Query activeOrder.customer.addresses to get data on any addresses used by [email protected] in the past.

This is a security hole which would expose details of previous guest checkouts, opening the door to enumeration attacks.

Mitigation

Disallow access to the customer entity unless authenticated. Check for any other possible vectors of a similar nature.

[heri16]

This is really bad