dualcube / moodle-enrol_stripepayment

Moodle Stripe Payment Collector
16 stars 27 forks source link

coupons that are not valid will silently fail #113

Closed jimcrammond closed 1 year ago

jimcrammond commented 1 year ago

A coupon may be invalid if it has expired or has maxed out on number of redemptions. If such a coupon is applied, it will not change the price but will not produce any indication of error.

The function stripepayment_couponsettings is invoked from a javascript promise. If it completes, it is treated as a success case in the calling javascript. Only if an exception is raised will the javascript print an invalidcoupon message. In the case of a non-existent coupon the exception path is executed but not in the way intended. The \Stripe\Coupon::retrieve() call raises an exception that is caught in stripepayment_couponsettings but then it proceeds to access $coupon->valid and since $coupon is not set, that raises an exception. The calling javascript executes the fail function - printing the invalid coupon message.

If the coupon does exist and is not valid, no exception is raised, the cost does not change but the calling javascript executes the success function which gives the appearence of doing nothing.

The attached patch will cause the invalid coupon message to appear in both cases. stripepayment-coupon.patch

Note that in this patch some of the "requires" calls are changed to "requires_once". Without this, when an exception is raised, it will add messages to the lib/ajax/error_log about undefined properties. Note that this is also a problem with other functions in externallib.php, but the other functions do not typically generate exceptions (I have seen examples of this in other issues though)