[Done v1.3.9a] Duplicate Orders/Order Confirmation

[paulm]

MODERATOR UPDATE: SEE FIX POSTED HERE: http://www.zen-cart.com/forum/showpo...1&postcount=49

================
As described by Beerman:

This problem is intermittent, and I have no firm idea why it happens...sometimes (perhaps 5% of the time) I get two order conformation emails (but payment is taken from the customers card only once).

There are more threads about the same issue, but I think this is the one that describes it best and lead to the solution: http://www.zen-cart.com/forum/showthread.php?t=70090

The fix is in post 30:
http://www.zen-cart.com/forum/showpo...3&postcount=30

And post 31 fixes a typo in the same file (not related to the duplicate orders issue):
http://www.zen-cart.com/forum/showpo...7&postcount=31


Note that this is not typical for paypal or any other payment module, and also that if you have duplicate orders all the time it's another issue.

I attached a zip to this post which includes a fixed version of /includes/modules/pages/checkout_confirmation/jscript_main.php , ready for Zen Cart 1.3.6-1.3.8 (and possibly other versions).


ZIP REMOVED, in favour of update posted here: http://www.zen-cart.com/forum/showth...034#post597034

[paulm]

I would like to confirm that this fix really works.

Installed it on a couple of shops over a month ago, one of which had intermittent duplicate orders daily, and there have been no duplicates since.

[hermes369]

For those using Authorize.net: they will no longer issue test credit card numbers. They suggest you talk to your Merchant Services Provider. Mine is Total Merchant Services. I've sent them an email and will call them to get the numbers. Can someone tell me why these numbers are dangerous? If I can be convinced there is no reason to fear posting these numbers, I'll post them here so the next poor ############## won't have to go through hell to test the fix.

P.S. I should have said 'Thank You!' for this fix!

[paulm]

I don't understand anything about your Authorize.net comment, but I think it's NOT related to this fix/thread!

P.S. I should have said 'Thank You!' for this fix!

(although I wonder if the fix does what you expect it to do, after reading the rest of your reply...)

[dhcernese]

The default tpl_check_confirmation_default.php, jscript_main.php for it seems confused to me.

If you look at the resulting <form> code, you'll see there is no input type="submit" on the form. Instead, there's one non-hidden input of type="image". That kind of input has an event "onclick", not "onsubmit". The form would have an onsubmit event, and that's how the jscript was tied in - except that there's only a default implied submit.

Perhaps not all browsers behaved the same and that's why the jscript had the submit inside it?

 
<form name="checkout_confirmation" action="https://www.myshop.com/shop/index.ph...eckout_process" method="post" id="checkout_confirmation" onsubmit="submitonce();"><input type="hidden" name="SecurePayCOM_cc_owner" value="Daniel Cernese" /><input type="hidden" name="SecurePayCOM_cc_expires" value="1008" /><input type="hidden" name="SecurePayCOM_cc_type" value="Visa" /><input type="hidden" name="SecurePayCOM_cc_number" value="XXXXXXXXXXXXXXXX" /><input type="hidden" name="SecurePayCOM_cc_cvv" value="426" /><input type="hidden" name="zenid" value="879e38df3c25fd87d7f6325cd738407f" /><div class="buttonRow forward"><input type="image" src="includes/templates/template_default/buttons/english/button_confirm_order.gif" alt="Confirm Order" title=" Confirm Order " name="btn_submit" id="btn_submit" /></div>
</form>

Perhaps IE7 (and others) now don't kick off the onsubmit if the the event is really onclick? I'm not getting any multiple-click prevention, I haven't tweaked this except to remove the document .submit inside the javascript as suggested.. ..and the form still gets submitted (some how).

I'm still investigating. I need to read up a little more on forms, submit, and input types to understand why this is not working.

[paulm]

If you look at the resulting <form> code, you'll see there is no input type="submit" on the form.

Who says there is, or that it should be there?

Instead, there's one non-hidden input of type="image".

Probably there is, but what is the problem with that?

That kind of input has an event "onclick", not "onsubmit".

So?

Perhaps not all browsers behaved the same and that's why the jscript had the submit inside it?

I doubt that, but I actually was hoping a zen dev could explain why it's there.... I am quite sure it's a line added to debug the script, which was left there by mistake.

I'm not getting any multiple-click prevention

That is strange. One thing that I am 100% sure of is that it prevents the IE7 duplicating clicks bug (user clicks once, but the form is submitted twice). I also haven't had any "normal" double click issues since, so I assume that part works too.

I need to read up a little more on forms, submit, and input types

I can't deny that

[paulm]

If you say "I'm not getting any multiple-click prevention", do you mean you can still double click and generate duplicate orders that way after replacing the file? Or do you still get duplicate orders form customers? Or?

[dhcernese]

If you say "I'm not getting any multiple-click prevention", do you mean you can still double click and generate duplicate orders that way after replacing the file? Or do you still get duplicate orders form customers? Or?

I replaced the file, I can click ~5 times and get as many order and credit card transactions. I verified the file is replaced and correct simply by 'view source' in the browser on the confirmation page before clicking.

I am quite sure it's a line added to debug the script, which was left there by mistake.

I don't know how to do fancy quoting here. I think you are mistaken. I'll try to find time to continue investigating.

[dhcernese]

Performing the submit from inside the javascript is the preferred way to submit a form when doing extra processing (either validation or preventing extra click). So, the question is, why did it stop working. Removing the submit as you did is really just confusing the behavior. I'm using it removed for now, but I don't know if I'll ever figure this out before by real day job takes over :-)

[paulm]

In this case (how Zen Cart handles it) the form is submitted normally (without using js), that is why the after submit in the js script is not logical.

I have written several small scripts to test the behavior, one that works as desired (tmho) is this: http://www.beterelectro.nl/tests/submit-once/

I also wrote an alike script to test the duplicate submits in IE7, and they really do when using the original Zen code, but due to the way the the duplicate submissions are tested I won't post a link to it.