In-Portal Issue Tracker

Welcome to the In-Portal Open Source CMS Issue Tracker! This is a central management / tracking tool for all types of tasks / issues / bugs for the In-Portal Project. Before reporting any issues, please make sure to read the Guide into Issue Tracker and How to Properly Test and Report Bugs!

Viewing Issue Simple Details [ Jump to Notes ] [ Wiki ]

[ View Advanced ] [ Issue History ] [ Print ]

ID

Category

Type

Reproducibility

Date Submitted

Last Update

0000660

[In-Portal CMS] Front End

bug report

always

2010-03-27 17:22

2011-03-30 09:58

Reporter

alex

View Status

public

Project Name

In-Commerce

Assigned To

alex

Developer

Priority

normal

Resolution

fixed

Fixed in Version

5.1.1-B1

Status

closed

Product Version

5.0.3-B1

Target Version

5.1.1

Time Estimate

No estimate

Summary

0000660: Order's user could reset to Guest during payment gateway processing

Description

Order's user could reset to Guest during payment gateway processing. This can happen because of check made in OrdersEventHandler::CheckUser method. That method checks, that user, who is currently being logged in is also mentioned as order's owner. In case if they doesn't match, then currency logged in user is placed in order. This raises a problem with "stupid" payment gateways, who doesn't understand dynamic callback url.

For example we have same installation (one copy of code, one database, multiple DNS records only) running on multiple domains, but payment processing always happens on central domain. In this case CheckUser method will reset owner of order in case order wasn't initially created on domain used for payment processing.

I propose to check for GW_NOTIFY constant (proposed to be added in another discussion) and not to perform any such checks when payment gateway notification is being processed.

Additional Information

Tags

No tags attached.

Reference

http://groups.google.com/group/in-portal-bugs/browse_thread/thread/9d25bc78e14b98b0

Change Log Message

Estimate Points

0

user_lost_during_payment_gw_processing.patch [^] (549 bytes) 2010-09-08 09:03 [Show Content]

Index: units/orders/orders_event_handler.php
===================================================================
--- units/orders/orders_event_handler.php	(revision 13919)
+++ units/orders/orders_event_handler.php	(working copy)
@@ -1247,7 +1247,9 @@
 	 */
 	function CheckUser(&$event)
 	{
-		if ($this->Application->isAdminUser) {
+		if ($this->Application->isAdminUser || defined('GW_NOTIFY')) {
+			// don't check for user in order while processing payment
+			// gateways, because they can do cross-domain ssl redirects
 			return;
 		}

Relationships [ Relation Graph ] [ Dependency Graph ]

Notes
(0002793) Dmitry (manager) 2010-09-08 23:26	Reviewed and tested okay, please commit.

(0002804) alex (manager) 2010-09-10 03:03	Fix committed to 5.1.x branch. Commit Message: Fixes 0000660: Order's user could reset to Guest during payment gateway processing

(0003390) Dmitry (manager) 2011-03-30 09:58	Closing, since 5.1.1 release has been released.

Related Changesets
Modules :: In-Commerce: 5.1.x r13930 Timestamp: 2010-09-10 03:03:12 Author: alex [ Details ] [ Diff ]	Fixes 0000660: Order's user could reset to Guest during payment gateway processing
	mod - /w/in-commerce/branches/5.1.x/units/orders/orders_event_handler.php		[ Diff ] [ File ]

Issue History
Date Modified	Username	Field	Change
2011-03-30 09:58	Dmitry	Note Added: 0003390
2011-03-30 09:58	Dmitry	Status	resolved => closed
2010-09-10 03:03	alex	Note Added: 0002804
2010-09-10 03:03	alex	Status	reviewed and tested => resolved
2010-09-10 03:03	alex	Fixed in Version	=> 5.1.1-B1
2010-09-10 03:03	alex	Resolution	open => fixed
2010-09-10 03:03	alex	Changeset attached	5.1.x r13930
2010-09-08 23:26	Dmitry	Note Added: 0002793
2010-09-08 23:26	Dmitry	Assigned To	Dmitry => alex
2010-09-08 23:26	Dmitry	Status	needs testing => reviewed and tested
2010-09-08 09:03	alex	Time Estimate Removed	1 =>
2010-09-08 09:03	alex	Assigned To	alex => Dmitry
2010-09-08 09:03	alex	Developer	=> alex
2010-09-08 09:03	alex	Status	needs work => needs testing
2010-09-08 09:03	alex	File Added: user_lost_during_payment_gw_processing.patch
2010-08-27 13:16	alex	Time Estimate Added	1
2010-07-31 13:34	Dmitry	Fixed in Version	5.1.1 =>
2010-07-31 13:34	Dmitry	Target Version	Icebox => 5.1.1
2010-07-31 13:33	Dmitry	Assigned To	=> alex
2010-07-31 13:33	Dmitry	Status	active => needs work
2010-07-31 13:33	Dmitry	Fixed in Version	=> 5.1.1
2010-05-10 14:51	alex	Target Version	5.0.4 => Icebox
2010-03-27 17:22	alex	New Issue
2010-03-27 17:22	alex	Reference	=> http://groups.google.com/group/in-portal-bugs/browse_thread/thread/9d25bc78e14b98b0

Web Development by Intechnic

In-Portal Open Source CMS

In-Portal Open Source CMS

Copyright © 2000 - 2009 MantisBT Group