[Done v1.3.9g] Order completes by "incorrect" payment method.

You can finish your order without selecting any payment method.

We are aware of this problem with ver.1.3.8x and 1.3.9x.

How to reproduce.

1, Number of installed payment module is 2.
2, Turn off the first installed payment module.(not uninstalled)
3, Go to the shop and proceed to the checkout_payment page.
4, Type the checkout_process page's URL into the browser.
5, Then Order finishes with "Gift Certificate/Coupon" as payment method.

In the case of zen-cart-v1.3.9x.
Installed payment modules are "cod" and "paypal".
MODULE_PAYMENT_INSTALLED => cod.php;paypal.php .
and first payment method "cod" is "$this->enabled = false;"

It seems, the problem starts here.

/includes/classes/payment.php
around line 84:

      if ( (zen_count_payment_modules() == 1) && (!isset($_SESSION['payment']) || (isset($_SESSION['payment']) && !is_object($_SESSION['payment']))) ) {
        if (!isset($credit_covers) || $credit_covers == FALSE) $_SESSION['payment'] = $include_modules[0]['class'];
      }

Without checking module's enabled flags, assign the "$include_modules[0]['class']" to "$_SESSION['payment']".

On the other hand, "zen_count_payment_modules()" checks module's enabled flag and returns "1".
But in the "$includes_modules", "array('cod.php','paypal.php');" is assinged.

Then as a result.

$_SESSION['payment'] = cod;

and under this situation, forcibly jump to the "checkout_process".
Then, in the "includes/class/order.php" , the target paymet module of "$class =& $_SESSION['payment'];" is "enabled = false",

                    'payment_method' => $GLOBALS[$class]->title,
                    'payment_module_code' => $GLOBALS[$class]->code,

will be blank.

from line 76 of /includes/classes/payment.php

        if ($this->paymentClass->enabled)
        {
          $GLOBALS[$include_modules[$i]['class']] = $this->paymentClass;
        }

After all, order conplets with PAYMENT_METHOD_GV .