Following up on my prior post about possible bug in zen cart and auto return.
It seems that zen cart is relying on PDT (payment data transfer) that is sent with auto return to fullfill order completion. However this data is soley intended for use to display transaction details to your customer on your webpage after they return. Not for orderfullment. IPN should be used for order confirmation, which does not require auto return...
I found this excerpt in the paypal documentation:
https://www.paypal.com/en_US/ebook/PP_OrderManagement_IntegrationGuide/intro.html#1016964
[quote]
Differences between Payment Data Transfer (PDT) and Instant Payment Notification (IPN)
PDT's primary function is to display payment transaction details to buyers when they are automatically redirected back to your site upon payment completion; however, there are cases where you will not receive notification of all transactions, such as with pending transactions, refunds, and reversals. For these reasons, or if you are using this data to fulfill orders, PayPal strongly recommends that you also enable Instant Payment Notification (IPN).
Both IPN and PDT send back the same data; however, there are several important differences.
PDT:
l
Is available only to merchants who integrate PayPal with their websites by using Website Payments Standard.
l
Requires Auto Return to be enabled.
l
Auto Return will include an ID that can be used to query PayPal for the complete transaction details.
l
It is possible to miss a notification if the user closes the browser before the redirection is complete.
IPN:
l
Does not require Auto Return to be enabled.
l
At the end of the website payment flow, PayPal POSTs the IPN data asynchronously (i.e. not as part of the website payment flow).
l
IPNs will also POST for eCheck clearings, reversals, and refunds.
[end quote]
Unless I hear someone has already code mod, I will start looking for a way to hack zencart implement IPN confirmation instead of PDT.