search

aimeos / aimeos-core

Aimeos PHP e-commerce framework for ultra fast online shops, scalable marketplaces, complex B2B applications and #gigacommerce
https://aimeos.org
Other
3.4k stars 118 forks source link

Checkout Session #165

Closed DavidHedden closed 5 years ago

DavidHedden commented 5 years ago

I've noticed that when an Order is done and the confirmation page is left open. Its possible to change the billing state via reload again. Shouldn't that be avoid ? My Setup is TYPO3 9.5.4 with Aimeos 19.4.1 tested with PrePay & PostPay

aimeos commented 5 years ago

Can you make screenshots to see what you mean?

DavidHedden commented 5 years ago

When an order is done, via PrePay & PostPay and the Billing state is changed in the backend. 2019-05-15_11h32_25 Its possible to change that back to the "waiting / authorized" state, if this page is reloaded 2019-05-15_11h30_40

aimeos commented 5 years ago

We could remove the last order ID from the session of the customer which would prevent that. The downside is that if customers reload the confirmation page (because the server is slow), they won't see their order and get only an error message which will make them think ordering failed.

As sessions usually have a limited life time the current behavior should have no consequences at all - or do you have a use case where it will result in a problem?

aimeos commented 5 years ago

Used another approach an limited setting the payment status only if status is "unfinished": https://github.com/aimeos/aimeos-core/commit/41ff87f30fcb9e51e8626883fef643c5e947b86b