search

strangerstudios / paid-memberships-pro

The Trusted Membership Platform That Grows with You: Restrict access to content and charge recurring subscriptions using Stripe, PayPal, and more. Fully open source. 100% GPL.
https://www.paidmembershipspro.com
Other
470 stars 359 forks source link

Double check that we process the PayPal Standard "subscr_payment" IPN message correctly #699

Open ideadude opened 6 years ago

ideadude commented 6 years ago

In the IPN handler it looks like we are treating "subscr_payment" messages as if they were initial payments that we have orders for when they are probably recurring payments we need to make new orders for. Let's test this.

https://github.com/strangerstudios/paid-memberships-pro/blob/dev/services/ipnhandler.php#L104-L143

ideadude commented 5 years ago

We've been able to recreate it (or see in the wild).

  1. Make sure PayPal IPN is not working.
  2. Have a user checkout with PayPal Standard.
  3. There will be an order in review status that is never updated to success.
  4. Fix the IPN sometime after checkout
  5. Now when the recurring order comes in, the old review order has the same item number and so is found.

Here: https://github.com/strangerstudios/paid-memberships-pro/blob/dev/services/ipnhandler.php#L108-L110

A recurring payment is coming in, but because the IPN was broken before, the original "review" status order from years ago was never marked as "success". So the first line there will be false, no successful order for this subscription. Then it will find an order with the same item number and assume that this is the first payment coming in from years ago. It just marks the old order as success. So you wouldn't see a new order at the top of the list.

ideadude commented 5 years ago

We could check the date of the IPN info and make sure it's not "too far" past the date of the old item number order.

If it is old... then maybe we can assume it's a recurring order. Can we assume that the initial order should be in success status? We could update the old order status and create a new one... and probably email the admin about what is happening.