Tell visitors why they've been logged out?

[kamion]

The FILENAME_TIME_OUT seems to be the page to go to whenever something goes wrong, but there's no mechanism to display the reason it gets there.

How can I change it so that it displays some helpful message depending on the reason the user got redirected there?

Example, if the user got kicked out from checkout_process due to CC Slamming, I want to display "Sorry, as a security measure, you have been logged out because you have made too many failed payment attempts. Please log in to try again."

How can I pass over an error code? Do I just add &error= to the redirect link and process that in pages/time_out/header_php.php?

[DrByte]

The whole idea behind the process of blocking credit card slamming is to NOT encourage them to come back. You DO NOT want people slamming credit card numbers on your site. It costs you a transaction fee every time they attempt to use a card, even if the card is declined. And you don't want to be the target that a fraud ring uses to test or exploit cards.

I don't recommend encouraging malicious visitors to "Please log in to try again." If anything you should be saying "Sorry, you've been locked out for suspected fraudulent abuse of credit cards. Come back tomorrow accompanied by your local police officer."

Pardon the sarcasm. No offense intended.

You're the only one reporting having any problems with the way things work presently, and that's probably because you're doing multiple tests of your own new payment gateway module implementation, so you are in fact doing an intentional "slamming" sort of activity.

[kamion]

The idea behind CC Slam prevention is to stop simple scripts, right? Functionally, adding the polite text message makes no difference. Even without the polite message, there's nothing to stop a malicious visitor to just log-in again after being booted out. I imagine they can even alter their scripts to log-in again after 'n' tries.

Anyway, a friendly informative response when things *DO* go wrong for the user (non-malicious) will give a good impression to the customer of your website and how professional it is. This isn't only limited to the CC slam case.

[DrByte]

If your customers are the type who can't type their credit card number correctly 3 times in a row, you're bound to have larger problems than them being logged out.

But, you'll do as you want, of course.

Add a messageStack call to every case where the redirect to that page occurs, and give them the "reason".

Do remember that there's a fine line between being 'informative" and "disclosing sensitive information". Tread carefully.
Also, be reminded that the more changes you make to core code, the more complicated your future upgrades will be too.

[kamion]

Thanks, DrByte. I appreciate your help and advice (and generally appreciative for the whole ZenCart). :)