Manual purchase allows freebies

michael-cannon commented 11 years ago

If you visit http://aihr.us/downloads/testimonials-widget-premium-wordpress-plugin/, click the "Add to Cart" WITHOUT clicking the plugin radio button, and click "Checkout". Now, you're moved onto giving your personal details and click "Complete Puchase".

Viola, you've successfully purchased a product for free. Confirmation page shows up as normal with a product download link that works.

Please download your digital media below. Payment: #15391 Date: January 12, 2013 Total Price: $0.00 Discount: none Payment Method: manual Payment Key: ec05696c5032d82580d3993520ed727a

Products

Name Price Total Price: $0.00 Testimonials Widget Premium Plugin for WordPress testimonials-widget-premium.zip $0.00

Is this a bug or a feature?

checkout

complete purchase

confirmation

chriscct7 commented 11 years ago

Do you have the manual payment gateway turned on?

michael-cannon commented 11 years ago

I've looked through settings for the manual option. Didn't find any. Read the docs regarding test payment, that's not active. I've resaved the options, but clicking "Add to cart" without clicking a specific product, one choice, still sticks the product in the cart with 0.00 price and complete purchase works.

To me… It seems that if there's only only price point, why not select that price automatically and then the "Add to cart" would stick the product and price point in normally.

Michael

Michael Cannon Chief Technology Officer • Aihr.us http://aihr.us/ • Website support made easy since 1999 Taiwan +886 (0)916 526 059 • US +1 617 539 6072 • Skype comprock

On Sat, Jan 12, 2013 at 9:52 PM, Chris Christoff notifications@github.comwrote:

Do you have the manual payment gateway turned on?

— Reply to this email directly or view it on GitHubhttps://github.com/pippinsplugins/Easy-Digital-Downloads/issues/752#issuecomment-12178334.

michael-cannon commented 11 years ago

Fixed, but code revision needed. See below.

I've noticed that other website EDD products have the first price point selected. Digging in, my first product has label for="edd_price_option_14714_2". I'm thinking that since the last numeric isn't 1, some JavaScript isn't automatically selecting. I've had multiple price points previously, but now not.

I think that in includes/template-functions.php, for checked( 0, $key, false ),, the $key needs to be redefined slightly. Below, I'm checking for one price point and adjusting $check_key to adapt for first item selection as needed. Otherwise, it's left alone.

if( $prices ): $one_item = false; if ( 1 == count( $prices ) ) $one_item = true; foreach( $prices as $key => $price ) : if ( $one_item ) $check_key = 0; else $check_key = $key; $amount = $price[ 'amount' ]; if( edd_use_taxes() && edd_taxes_on_prices() ) $amount += edd_calculate_tax( $price[ 'amount' ] ); printf( '<li><label for="%2$s"><input type="radio" %1$s name="edd_options[price_id]" id="%2$s" class="%3$s" value="%4$s"/> %5$s</label></li>', checked( 0, $check_key, false ),

chriscct7 commented 11 years ago

@pippinsplugins 1.4.2?

michael-cannon commented 11 years ago

I think you're asking about version, Version 1.4.0.3 of EDD.

Michael

Michael Cannon Chief Technology Officer • Aihr.us http://aihr.us/ • Website support made easy since 1999 Taiwan +886 (0)916 526 059 • US +1 617 539 6072 • Skype comprock

On Sat, Jan 12, 2013 at 11:42 PM, Chris Christoff notifications@github.comwrote:

@pippinsplugins https://github.com/pippinsplugins 1.4.2?

— Reply to this email directly or view it on GitHubhttps://github.com/pippinsplugins/Easy-Digital-Downloads/issues/752#issuecomment-12179763.

chriscct7 commented 11 years ago

Hm? No, I was referring to tagging this as an issue to fix for EDD 1.4.2.

pippinsplugins commented 11 years ago

This definitely needs to be fixed for v1.4.2, though I don't think just making sure the radio button is checked is sufficient. This hints at a vulnerability in the purchase processing function.

Here's what needs to happen:

If the product has variable prices enabled, a price ID MUST be sent through with the purchase data
When no radio button is checked, no price ID is getting sent (this should generate an error or default to the first price option)

This should be as simple as checking whether variable prices are enabled while processing the cart contents.

theGuruWithin commented 11 years ago

IMHO perhaps a remove variable pricing structure if it is removed so no radio button if only 1 choice.

michael-cannon commented 11 years ago

I just noticed that I still did have "Enable variable pricing" checked. Unchecking that and reseting my price point fixes the freebie. However, it's still possible to check out without selecting a price point under variable options.

Therefore, there stil is a bug.

pippinsplugins commented 11 years ago

It's definitely still a bug. We'll make sure it is fixed for 1.4.2.

pippinsplugins commented 11 years ago

Hmm, I can't seem to replicate this. What I did:

Created a download with variable prices
Added a single variable price option
Viewed the download on the front end
Made sure that the radio button for the price was unchecked
Added the item to the cart
Went to the cart
The cart showed that I was purchasing the First (and only) price option for the product, exactly as should happen (defaults to price 1).

Did I do something different than you?

michael-cannon commented 11 years ago

Oh add, multiple prices point, then delete the first one.

Michael

Michael Cannon Chief Technology Officer • Aihr.us http://aihr.us/ • Website support made easy since 1999 Taiwan +886 (0)916 526 059 • US +1 617 539 6072 • Skype comprock

On Thu, Jan 17, 2013 at 1:38 AM, Pippin Williamson <notifications@github.com

wrote:

Hmm, I can't seem to replicate this. What I did:

Created a download with variable prices

Added a single variable price option

Viewed the download on the front end

Made sure that the radio button for the price was unchecked

Added the item to the cart

Went to the cart

The cart showed that I was purchasing the First (and only) price option for the product, exactly as should happen (defaults to price 1).

Did I do something different than you?

— Reply to this email directly or view it on GitHubhttps://github.com/pippinsplugins/Easy-Digital-Downloads/issues/752#issuecomment-12330367.

pippinsplugins commented 11 years ago

Aha! That does it.

pippinsplugins commented 11 years ago

Rekeying the array on save fixes the problem.

awesomemotive / easy-digital-downloads