Order came through with gift certificate, and several line items of same product

[zilly]

Order came through saying payment method was gift certificate / coupon. However received a mating declined CC transaction. Order had 4 line items for the 1 product
17 x product A
2 x product A
3 x product A
5 x product A

We don't have Gift certificates turned on. (do have coupons)
Since it hit the CC site, I think it also went through the eWay Credit Card payment module.

Any ideas on how the order came through with the product split over for line items, and the gift certificate saying it was successful



PHP Version: 7.0.33
DB: 10.1.34-MariaDB

[DrByte]

The payment module is supposed to never let the order proceed to "success" unless payment is successful.

An order is always assumed to be "paid" when it reaches the point where it can be saved and emails can be sent.
When the order is calculating what to record as the "method of payment", it uses whatever payment module was invoked.
But if the module has somehow disabled itself (even if only for that order), or the customer's shopping experience/session has been disconnected from the actual payment session and cannot be reintegrated, then no payment module will be found.
When the order sees that no payment module is able to be named for the order, it falls back on understanding that the order mush have been paid-for with discounts that made the order no longer require any payment module, eg: paid by gift certificate that covered the entire order amount, or coupons or other credits that made no payment module necessary.

Perhaps your payment module needs some updating?

[zilly]

Looking at the logs they were sending stuff to the checkout_process and checkout_success through a script. But also according to the logs none of those succeeded, as I don't see any 200s in the logs. Only 404 and 302. So I'm not convinced it was from the payment module. But I can't work out where their script actually works.

Does the order consider itself paid when checkout_success is true, cause I can't find any evidence of a successful checkout_success. except by seeing that it exists.

[zilly]

Looking at the logs, the CC payment module said it was declined and never successful, so I can't work out where it could have become successful.

[kuroobiya]

We have just had a similar problem that we have never had before. I believe it could be related to the fact that we have recently added a second payment module (Square) in addition to PayPal. In our case the person managed to purchase a product at all zero cost, with no attributes (despite the product having many attributes). shipping cost was also at zero and payment method displayed as Gift Certificate/Coupon despite never having issued such a certificate.
I read on another thread earlier on today that with previous versions of ZC (1.3.9) it was possible to trick the system into producing a cod even if cod module wasn't installed and it would then show the payment method as Gift Certificate/Coupon. I am looking for the thread again but can't find it.

I believe it is a scammer. He keeps emailing every few hours asking where his goods are. (Currently ignoring him).

Is this a continuing bug in Zen Cart? Is it fixable? Should we remove the Square payment module?

Any help would be appreciated.


ZC version:v1.5.6c
PHP Version: 7.2.33 (Zend: 3.2.0)

[mc12345678]

We have just had a similar problem that we have never had before. I believe it could be related to the fact that we have recently added a second payment module (Square) in addition to PayPal. In our case the person managed to purchase a product at all zero cost, with no attributes (despite the product having many attributes). shipping cost was also at zero and payment method displayed as Gift Certificate/Coupon despite never having issued such a certificate.
I read on another thread earlier on today that with previous versions of ZC (1.3.9) it was possible to trick the system into producing a cod even if cod module wasn't installed and it would then show the payment method as Gift Certificate/Coupon. I am looking for the thread again but can't find it.

I believe it is a scammer. He keeps emailing every few hours asking where his goods are. (Currently ignoring him).

Is this a continuing bug in Zen Cart? Is it fixable? Should we remove the Square payment module?

Any help would be appreciated.


ZC version:v1.5.6c
PHP Version: 7.2.33 (Zend: 3.2.0)

A product that is expected to have attributes and in particular is priced by attribute, where indication of those attributes is removed from the html of the page prior to submitting the product to the cart can result in this "zero priced" product being added to the cart and checkout to then follow with no monies collected. As for your previous post search, should be able to use your browser history to go back through all of the reviewed pages to find that link. :)

It is also possible that the settings for the product and incorrect attribute settings could cause one to think that they have actually purchased a product (which is identified as free). It would be no surprise that a customer who believes that they have done everything right to obtain a product that is free would be disappointed at not having received it...

If they were malicious about trying to get it for free, then that's something different. If nothing else, could point out that the product selected did not provide any identification about which specific product was to be received, therefore it is not possible to provide it to them and that they may need to access the site again to select a specific product by making attribute selections.

Would suggest starting a new thread to address the attribute issues as at least in this thread the OP doesn't (yet) appear to relate in quite the same way. When doing so, please be sure to address the posting tips to include other installed software. I personally don't think that the Square module is the source of this issue and that purchases should continue to be reviewed for accuracy as would be expected at any time for any order.

[kuroobiya]

Thank you for your fast reply mc12345678. I really appreciate it.

Regarding the attributes, there is no problem with them and there has not been a problem with them for the last 13 years where they have remained constant. We have again tested to make sure and cannot find any problems however the attributes are manipulated. Even if no attributes are selected, the system will automatically select the default attributes. As I said, this is the first time this has ever happened in 13 years.

Regarding the post thread (sorry I was on a different computer at a different location so could not do a history search), I found one of the links (within that there is a link)

https://www.zen-cart.com/showthread....ificate-Coupon

I believe this is a similar situation to the original post here and our situation.


You said,

A product that is expected to have attributes and in particular is priced by attribute, where indication of those attributes is removed from the html of the page prior to submitting the product to the cart can result in this "zero priced" product being added to the cart and checkout to then follow with no monies collected.

How would that be remove that from the HTML? (unless done maliciously by them, as it was not us)

The same person has now tried to purchase a completely different items from the website, using a different account and email address (same name and address for billing I assume) but this time attempting to use payment but is being rejected by Square.

Is it possible that it is in fact a genuine mistake and this is a legit customer having trouble? So far, I have not reached out.