IDOR in orders: see placed orders you don't own

Lesson#14 of 24 in project Theory

GET /api/v1/orders/{id}