Promokit Helpdesk Alysum

On PrestaShop 9.2.0, using the Alysum theme with pkelements, creativeelements, and pklib active, an anonymous visitor may see another visitor’s product in the side cart (`<template id=”cart-sidebar-template”>`), even though their own actual cart is empty (`prestashop.cart.products_count = 0`).

Reproduction (verified using `curl`, with LiteSpeed/CDN caching disabled; headers set to `no-store`):
Customer A (anonymous) adds a product to their cart.
Customer B (anonymous, with different cookies and an empty cart) opens any page.
Customer B’s footer displays Customer A’s cart contents (product name, price, total). In 3 out of 3 test requests, the content shown to Customer B was identical to that of Customer A.

The file `pkelements/src/Hooks/DisplayBeforeBodyClosingTag.php` caches the entire end-of-page block (saved with the `.pkel.endofpage` extension). This block includes the cart (via `ps_shoppingcart→getWidgetVariables`), as well as favorites and account information.
The `pklib\Cache::getCacheId()` method generates a cache key based solely on `customer→id`, currency, language, and store. For all anonymous users, `customer→id` is `null`, resulting in an identical cache key; the first user to trigger the cache generation sets it for everyone.
Furthermore, for logged-in users, the side cart fails to update because the cache is not invalidated by cart-related events (it is only cleared via `clearWidgetsCache()` during administrative actions).
A similar pattern exists in `creativeelements/includes/base/element-base.php` (around line 713, within the `ce` cache mechanism), which stores the HTML for individual elements using the same key. Consequently, any widget containing user-specific data such as cart counters, favorites, product comparisons, or “recently viewed” lists is exposed to the same risk.

Everything that depends on the shopping cart, guest status, cookies, or the customer should be excluded from the shared cache.
For instance, you could avoid caching the “end-of-page” block or specific widgets that rely on user state; alternatively, you could include a cart or visitor identifier in the cache key while carefully assessing the impact on the files generated within `var/cache` or trigger a cache invalidation whenever cart-related events occur.