1 / 2
Every single letter
June put single-letter shortcuts on the staff orders tool. Toby typed 'delivered' on a real order and it was refunded and deleted by the third letter.
The mistake
The shortcut handler is bound at the document level and fires on every keypress without checking whether focus is inside a text input, so keystrokes meant for the note field are also interpreted as commands. Typing 'delivered' sends D, which triggers the delete action on the currently selected order, and the destructive handlers run immediately with no confirmation step or undo. The same bug then repeats in the deleted-orders search box, where typing 'RED' fires the refund and delete shortcuts again.
- internal-tools
- admin-tools
- keyboard-shortcuts
- frontend
- release