Cancel and Return from paypal

[JoeAucoin]

When testing payments with PayPal if the user hits "Cancel and Return to 'Merchant Name'" the return URL looks like:

/Shop/Payment/orderid/103/status/0

but the page is blank and the user is not informed that the order has not been paid for . . .the page loads fine, but there is no content or message.

Suggest adding methods for better handling of "Cancel and Return to Merchant" link from PayPal

When playing with the URL if I change it to: /Shop/Payment/orderid/103/status/30 the order appears to complete with the page content of:

====== PAGE CONTENT ========== Your shopping basket Order process Basket Addresses Summary PaymentConfirmation Payment Complete Thank you for your order. You will receive an emailed confirmation containing all order details. Please check your junk email folders if you don't receive it within 30 minutes. Take note of the number below if you wish to contact us about this order.

Order number: 181018103 View Order

The users order history shows the order with "Payment not Verified" Same in BackOffice

Thanks, Joe

[leedavi]

Hi Joe, Is the payment module on that return page, it's that which handles the process.

The payment provider gets a chance to process the response (I'm unsure what the free paypal one does), if the payment provider does not return a valid respsone, then OS will send a respsone to the payment modules of success or fail, and update the order audit history.

A email response comes from OS only when successful, not when failed. (That would need to be dealt with by the payment provider, if you need that)

You can also have plugins that check the order update event and can trigger custom emails based on the situation.

I don't think this is an OpenStore issue, it's more to do with the payment provider and how that processors.

Make sure you have the payment module on that page. The "payment not verified" happens when the IPN is not received. Check the IPN url.

Here is the docs, but I think they may need improving in this area.

https://doc.openstore-ecommerce.com/#11476

Let me know how you get on.

[JoeAucoin]

thanks for your reply . . .

Yes, the payment module is on the return page. Just to be clear, the order does not complete on the last screenshot. I would think in this case the order should be marked as Incomplete 010 and the customer should be notified as such.

Screenshots: https://photos.app.goo.gl/usvcDqgREXBaRCDP9

But . . . If I modify the last URL to status=30 an update event is triggered marking the order as "Payment Not Verified" and customer is emailed an order confirmation like it was paid.

Feel free to play with my testing site if you wish.

[leedavi]

Yes, on the first url you give "/Shop/Payment/orderid/103/status/0" the status=0 means the payment fail. Hence it will stay incomplete. and will not send an email. Because the payment has failed and there is nothing the e-commerce manager needs to do. It's the client who needs to retry to pay.

The "payment not verify" is when the payment is successful but no IPN was received, so the manager needs to check the payment in the bank. In this case an email is sent to the manager. Check your emails are working and being received and not going into span folder or something else.

On the images, there is no message for the payment module when the status is 0. this is not normal, there should be a fail message. because the status = 0.

Check the settings of the payment module are using the "ClassicAjax" Theme.

What version of OpenStore are you using?

[JoeAucoin]

Using OS 4.0.5 on DNN 9.1.1 running on Azure Apps

I was using "Default" theme . . . as I do not have a file called Payment.cshtml in and ClassicAjax folder . . .

I changed to "ClassicAjax" Theme and now find that it works. Confused on how that works with no Payment.cshtml in the ClassicAjax/Default folder. I just wanted to make you aware of the possible security flaw of someone changing the URL.

[leedavi]

I'm surprised the "Default" theme didn't pickup the "payment_fail.cshtml" template. The system is designed to search the module theme for the template and then drop back to the store "Default" theme. Therefore those templates are not needed in the "ClassicAjax"

I think this might highlight a code path flow problem, I'll check that.

The security is covered. The order will only be accepted if the correct status are applied (You can't fail an accepted order, you also have an audit history). Plus the only way it can automatically move to Payment OK is if the IPN from the bank is matching all criteria. This is different for each bank and should be dealt with by the payment provider gateway, in the correct security way for that gateway. (Of course we can't cover for poor security implementation in the payment provider)

If any hacker can time it perfectly, they will only ever be able to make the order go to "Payment Unverifed", which obviously means the manager needs to check it in the bank before sending goods.

But send me a PM if you do find any security issue.

[JoeAucoin]

I've been doing some more testing and I am still sometimes getting a blank page on cancel from Paypal. I do find if I reload the page the Payment Failed message does appear.

Another question . . . should all my store modules have "Classic Ajax" as the selected folder in Settings? I've been sometimes seeing blank pages for Order History. If I then navigate to another page and then come back it appears

[leedavi]

yes on the "ClassicAjax" best keep all modules using it. Keeps it standard that way, but template may be in ClassicAjax or default.

The order history being blank is strange. I've never had the problem and it's never been reported before. I'm fairly sure our client would point out such an error with their day to day working tool. Can you recreate on the demo? https://demo.openstore-ecommerce.com/fr-fr/

Same with the return page.... could it be the browser caching?

[JoeAucoin]

Site seems to be working better when I change all the modules to "ClassicAjax".

I'll keep you posted.

Merci beaucoup

[JoeAucoin]

WOW . . . what a vast improvement in the speed by changing all the modules to "ClassicAjax". It seems to have cleared most bugs I was seeing.

Although I am still getting a blank page on cancel from Paypal. I do find if I reload the page the Payment Failed message does appear. Not a deal killer for me, but I thought you should know.

[leedavi]

OK, good to know. None of my client use Paypal, but I'll try and find the time to test this and see if I can recreate this problem.

We should have this discussion on the forum: http://forum.openstore-ecommerce.com/

If I can see the site, Private Message me a link on the forum and I'll have a look.

[leedavi]

I'll also make a note of the module problems with not using "ClassicAjax", Ideally we would have a full theme that can be used in the modules. But splinting the theme is easier to adapt. I'm not a designer, so the choice wasn't mine, but if it's causing a problem it stops people adopting OpenStore and we'll need to change/fix it.