Possible problem

Hello,

I am not exactly sure how PayPal reports back to zen cart that the order has been paid, but using the problem TamperIE I was able to alter the amount being passed to PayPal that is supposed to be paid from 51.03 to 1.03 not sure if PayPal sends back to Zen cart just approved or declined or if it send back the amount paid.

If it just reports paid or not paid, someone not paying attention could send out an order thinking they got paid the full amount only to find out that they only got paid less than supposed to, or if it send back an amount, if the information being sent back is not encrypted the number might be able to be changed to show that original amount was paid, and the same issue with shipping may happen.

Not having 2 PayPal accounts I was not able to pay myself to see how the data is sent back to Zen Cart.

Just thought I would bring this issue to attention. Don't know if there is a way to encrypt the data going to PayPal to make it harder to tamper with what is being sent to PayPal.

Of the three PayPal modules, which one are you using?
If you're using the archaic "Website Payments Standard" method, then yes it's easy to spoof the amount that gets paid. But the final payment won't activate the submitted order because the price won't match.
If you're using Express Checkout, then it's somewhat harder to spoof the transaction in the first place.

A merchant should always verify the amount paid anyway.

It is the normal web site payments i guess its not express. But if its not going to catch cause of price not matching I guess its ok, just wanted to make sure.

You're ALWAYS better off using Express Checkout, because it's far more reliable anyway. And the customer experience is the same in the end too, so it's a win-win.

The old Website Payments Standard approach should be a last-resort, and NOT a primary first choice.

Alright thank you for the advice I will setup express. That's good information to know. Thank you for your help.