Mail.ru: idor leads to leak order information

IDOR in zakazaka.ru API allowed to list items of order content without attribution to user...