recorded a order in admin without payment

[snowrabbit]

I found a thing after testing in my store.

 

I login as a customer, select paypal payment method. before clicking "confirm order" button, I go to the browser, change the current http://domain//checkout_confirmation.php to http://domain//checkout_success.php, press enter.

it will crate a order recodes in admin without receiving payment from customer.

 

So be sure to check both admin-order and your paypal account to confirm that if you received the payment.

[web-project]

I login as a customer, select paypal payment method. before clicking "confirm order" button, I go to the browser, change the current http://domain//check...onfirmation.php to http://domain//checkout_success.php, press enter.

it will crate a order recodes in admin without receiving payment from customer.

can be secured, if it's not. As you can simply check the previous URL location in checkout_success.php. Also I want to point out that the confirmed payment put extra order status with confirmation of payment.

 

So be sure to check both admin-order and your paypal account to confirm that if you received the payment.

as part of order process, you need to check the payments

[midpen]

I found a thing after testing in my store.

 

I login as a customer, select paypal payment method. before clicking "confirm order" button, I go to the browser, change the current http://domain//checkout_confirmation.php to http://domain//checkout_success.php, press enter.

it will crate a order recodes in admin without receiving payment from customer.

 

So be sure to check both admin-order and your paypal account to confirm that if you received the payment.

 

I found the same issue.

 

When selecting paypal as a payment, after clicking on the step "confirm order" , change the browser URL to your domain/checkout_success.php without making a payment.

 

It will definitely create a order in your admin and in the customer's order history as well.

[Guest]

This is a known issue with PayPal Standard. I would suggest using PayPal IPN if possible. If not, verify payment at PayPal before shipping anything.

 

 

 

 

Chris

[jhande]

This is a known issue with PayPal Standard. I would suggest using PayPal IPN if possible. If not, verify payment at PayPal before shipping anything.

 

 

 

 

Chris

 

PayPal IPN v2.3.3

[Ben Nevis]

This is a known issue. I think the paypal_standard module has a pending order status and a payment confirmed order status. If the customer does what snowrabbit describes the order status is set to the pending status, not the payment confirmed status. What is needed then is to set the status for 'pending' differently from the confirmed status. You can know that the payment didn't complete because the order status will show whatever you set for 'pending'.

 

Really this isn't so much of an issue unless you are selling downloadables and have the order statuses set to allow download once payment completes. If the pending/confirmed statuses are not correctly set in that case a customer could get the downloadable product without having paid anything. So far as physicals are concerned, you just wouldn't send them out anyway unless you'd actually seen the money in the paypal account, presumably, so I guess there should be less risk of losing anything over it?

 

Anyway the or a solution to it lies just in setting the pending status and not sending goods until you have confirmed the payment.