From 598a346001ce0351eeaebf29c7fcfee77170e4c7 Mon Sep 17 00:00:00 2001
From: boo-code <boo-code@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:33:13 +0200
Subject: [PATCH] Submit the guest order tracking form with POST

The form carries the shopper's email address, and submitting it with GET puts
that address in the URL. It is then recorded by analytics as a page path, kept
in the browser history and written to the access log and any referrer.

The controller reads the fields with Tools::getValue(), which takes POST as
well, so no controller change is needed and links that already carry the
parameters in a query string keep working.
---
 templates/customer/guest-login.tpl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/templates/customer/guest-login.tpl b/templates/customer/guest-login.tpl
index df068496..4b6646a5 100644
--- a/templates/customer/guest-login.tpl
+++ b/templates/customer/guest-login.tpl
@@ -29,7 +29,11 @@
 {/block}
 
 {block name='page_content'}
-  <form id="guestOrderTrackingForm" action="{$urls.pages.guest_tracking}" method="get">
+  {* Submitted with POST so the shopper's email address does not end up in the URL, where it reaches
+     analytics as a page path, the browser history, the access log and any referrer. The controller reads
+     the fields with Tools::getValue(), which takes POST as well, and links that already carry the
+     parameters in a query string keep working. *}
+  <form id="guestOrderTrackingForm" action="{$urls.pages.guest_tracking}" method="post">
     <header>
       <p>{l s='To track your order, please enter the following information:' d='Shop.Theme.Customeraccount'}</p>
     </header>