Wrongly Re-Used PAYONE Transaction

PAYONE-GmbH / magento-1

PAYONE Payment Extension for Magento 1

22 stars 40 forks source link

Wrongly Re-Used PAYONE Transaction #396

Open sprankhub opened 4 years ago

sprankhub commented 4 years ago

To be honest, I did not have the time to fully reproduce the issue, but I think it is worth reporting anyway. Especially, because I think it could be reproducable on your side :-)

Magento 1.9.4.3 Payone_Core 4.5.0

Add a product to the cart for e.g. 40 EUR.
Apply a 10 EUR voucher code. Hence, the order amount is 30 EUR.
Start payment via PAYONE. In our case, this was Sofortüberweisung.
Cancel payment or enter invalid data (not sure how this happened exactly).
Now the order is created in the Magento backend, but is canceled, which is totally correct.
Now order the same product again without applying the voucher code (maybe it is still in the cart after the payment has been canceled?). Hence, the order amount is 40 EUR.
Successfully pay with the same payment method.
Now a second order is created, but the same PAYONE transaction is re-used.

This leads to the issue that the order is correctly created with 40 EUR total amount in Magento, but only 30 EUR are paid at PAYONE, because the same PAYONE transaction is used (the transaction ID is the same).

fjbender commented 4 years ago

I am having a hard time reproducing this. It seems to be impossible to remove a voucher code from the basket once it's in there. For me, the voucher remains in the basket so the amount is always reduced. Only killing off the session gets rid of the coupon.

sprankhub commented 4 years ago

Sorry for that! I hoped that this is easier :-) So even though I am sure the customer did not do that, did you try to submit an empty or invalid coupon code? This should remove the code I guess. Not sure if the issue is reproducible like that, but maybe it helps.

fjbender commented 4 years ago

Nope, it's also not possible to reproduce it with submitting an empty code. Sorry :/

sprankhub commented 4 years ago

We just had a similar case. Let us simplify this and set aside the coupon code:

Add a product to the cart.
Start payment via PAYONE. In our case, this was PayPal.
Cancel payment / press back button (make sure Payone_Core_Checkout_Onepage_PaymentController::backAction is called).
Now the order is created in the Magento backend, but is canceled, which is totally correct.
Additionally, the quote is re-activated. You should still see your current shopping cart.
Now order again with PayPal and successfully complete the payment.

If you do this, there are multiple issues:

The same PAYONE transaction is used. Hence, both orders have the same PAYONE transaction ID.
In the PAYONE backend, there is only a reference to the first, cancelled order.

This leads to the issue that accounting cannot map the invoice (second successful order) to the payment (first order).

Can you reproduce this issue more easily, @fjbender?

fjbender commented 4 years ago

Well, this is weird. With the "second" order, the Payone plattform issues a new transaction ID, which should subsequently used, as the first one is "burned". And this is exactly the case when I try to reproduce this. I used the "Back to $Merchantname" Link on the PayPal page, because any usage of the browser's back button got be back to an empty basket and a canceled order.