Almaqam-Final Phase-Web

Hotel and air voucher pages can currently be opened directly via URL without any login, allowing unauthorized access. By changing the transaction ID in the URL, users can view other customers’ records. These voucher URLs must be protected so that they are accessible only during an active authenticated session (for in-house agents, B2B agents, or end users). Unauthorized access should be fully blocked.

For Reference:
https://b2cadmin.almaqam.com//PHPMail/PropertyTicket?TransactionID=3143&TransactionDetailID=3143&TransactionTypeID=3&Culture=en&HidePrice=false&HidePolicy=true&IsFixedPackage=false