From d07b504a9026cd16947e54901b8520c23dd64d0d Mon Sep 17 00:00:00 2001
From: boo-code <boo-code@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:33:13 +0200
Subject: [PATCH] Submit the guest order tracking form with POST

The form carries the shopper's email address, and submitting it with GET puts
that address in the URL. It is then recorded by analytics as a page path, kept
in the browser history and written to the access log and any referrer.

The controller reads the fields with Tools::getValue(), which takes POST as
well, so no controller change is needed and links that already carry the
parameters in a query string keep working.
---
 templates/customer/guest-login.tpl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/templates/customer/guest-login.tpl b/templates/customer/guest-login.tpl
index 5fc30640f..6b74212ad 100644
--- a/templates/customer/guest-login.tpl
+++ b/templates/customer/guest-login.tpl
@@ -11,7 +11,11 @@
 {/block}
 
 {block name='page_content'}
-  <form id="guestOrderTrackingForm" action="{$urls.pages.guest_tracking}" method="get">
+  {* Submitted with POST so the shopper's email address does not end up in the URL, where it reaches
+     analytics as a page path, the browser history, the access log and any referrer. The controller reads
+     the fields with Tools::getValue(), which takes POST as well, and links that already carry the
+     parameters in a query string keep working. *}
+  <form id="guestOrderTrackingForm" action="{$urls.pages.guest_tracking}" method="post">
     <input type="hidden" name="controller" value="guest-tracking">
 
     <p>{l s='To track your order, please enter the following information:' d='Shop.Theme.Customeraccount'}</p>