Skip,
This is NOT a flame. It is a heads up regarding a problem on one of my sites: www.american-savage.com
ZENCART Version 1.5
PHP Version 5.2.17
MySQL Version 5.5.29
Server OS Linux 2.6.32 on Apache
Host justhost.com
Three or four months ago I installed the contest and included an image and a product to be given away as a prize. It was tested and it worked great. It is a good add-on for sure.
The store owner decided not to run the contest; however, so I turned off the prize product and the contest. Neither were visible to any customers.
A couple of weeks ago, PayPal sent me a purchase notification, so I went to the admin area and sure enough, someone from Chile (victor gonzalez) had purchased the prize using "Freecharger" for the payment. I went to the Payment Options, and Freecharger was in fact turned on. I went to PayPal, and everything was there except for the shipping... Mr. Gonzalez provided me no shipping information.
How was it possible for anyone to even find the item, much less purchase it? Is there perhaps a flaw in the code allowing someone to "find" the prize and make a purchase? Or, what other possibility is there.
I have turned off Freecharger, and deleted the prize.
Thank you,
jund (John Underwood)