Wrong Delivery Address in Orders

[anas78]

We are having problems with orders. We've had customers complaining that they see errors in Shipping Address during the checkout process.

 

We noticed that there were about five orders from a user S_B and while analyzing this, we found that the Shipping Address was different in each of the orders, we contacted S_B and he says that he has made just one order.

 

Some other users complain that while trying to make an order, they see a new Shipping Address during the process. They are not able to edit the Shipping Address also.

 

While analysing the issue, we noticed that there seems to be a problem with the address_book table. That is where person X's contact address is stored with person A's customer id.

 

The problem now is that we are not able to reproduce the error. Could you please tell us where to look for or what might be wrong?

 

Regards,

Anas.

[Guest]

You hit the nail right on the head.

 

http://www.oscommerce.com/forums/index.php?sho...90entry368690

 

-jared

[anas78]

I think I have a solution after reading a few other topics in this forum. :thumbsup:

 

The problem seems to be with the session id in the URL.

 

Here is a typical scenario:

 

* A Search Engine indexes the search engine and stores search results with oscId=987ff98asfdfa

* User A searches for a product or something else and somes across this URL and clicks it

* Now, user A's cart has a few products in it or he is logged in as another user

 

This is what seems to happen. The problem seems to be with oscId.

 

We found two possible solutions for this.

 

1. Store sessions in cookies. This can be done by using "Force Cookies" option in Admin>Configuration>Cookies

 

This might not help if you have different domains for HTTP and HTTPS. That is if you use a shared SSL key and have URLs like:

 

http://www.yourdomain.com/catalog

 

&

 

https://secure.yourprovider.com/yourname/ca...ut_shipping.php

 

So, the other option is:

 

2. You can block (known) search engines from indexing with oscid and enable "Check IP Address" in admin>Configuration>Sessions

 

This seems to have fixed the problem, but the wrong entries in address_book and orders have to be cleared manually.

 

Regards,

Sarath & Anas.