5 replies [Last post]
akamarvin's picture
Offline
Joined: 11/19/2007
Juice: 18
Was this information Helpful?

Ubercart alpha8, drupal 5.5, mysql 5.0.x

Problem :

Concerning a site with the wanted behaviour of no possible anonymous order.

An authenticated user is under certain circumstances able to validate a cart and a payment ... but the order in the database is saved with the uid = 0 !

Terrible consequences :
the customer/user was able to pay but our admin section could not say who passed this order ! And thus the user never see his order on his order history page.

I observed this 2 or 3 times, I believe the scenario for it to happen is when a user hesitate and comes back on the checkout pages many times with the same cart/order before submitting it to pay it.

Because I really do not need anonymous purchase in my case, I changed the uc_cart_checkout_form_submit() in uc_cart.module to force the $order->uid to be set in the beginning else statement.

function uc_cart_checkout_form_submit($form_id, $form_values) {
  global $user;

  if (empty($_SESSION['cart_order'])) {
    $order = uc_order_new($user->uid);
    $_SESSION['cart_order'] = $order->order_id;
  }
  else {
    $order = new stdClass();
    $order->order_id = $_SESSION['cart_order'];
    // AKAMARVIN MODIF : force the session uid in $order->uid (2008/01/11)
    $order->uid = $user->uid;
    // END AKAMARVIN MODIF
    $order->order_status = uc_order_state_default('in_checkout');
  }

  (...)
  uc_order_save($order);
  (...)
}

so the uc_order_save() function is sure to have a complete $order object at this time of the checkout.

And i also changed the uc_order_new() in uc_order.module to disallow the insert of uid = 0.

Feel free to comment my hack and this strange behaviour that should not happen.

Thanks.

Ryan's picture
Offline
Joined: 08/07/2007
Juice: 15438
Re: authenticated user able to place an anonymous order

Interesting... I've reviewed this, and I really just don't know how an order would come in w/o a uid attached. The first time this form is submitted, it should create an order for the customer's uid and save it. On subsequent submissions, that order should get loaded along w/ it's uid. I have included your change, and hopefully this solves something. Sticking out tongue I'm still curious to know more about whether or not this is the root issue.

zmove's picture
Offline
Bug FinderEarly adopter... addicted to alphas.Getting busy with the Ubercode.Internationalizationizer
Joined: 08/13/2007
Juice: 1192
Re: authenticated user able to place an anonymous order

Hi, Just to know, what payment system you use when you notice the bug ?

akamarvin's picture
Offline
Joined: 11/19/2007
Juice: 18
Re: Re: authenticated user able to place an anonymous order

A modified, and hopefully working ( because the original was quite crappy) version of uc_ogone (belgium).

do you think the payment module could mess up the order->uid with another uc_order_save ?

because I believe the only way to update or mess up the uc_order record in db is with uc_order_save() or uc_order_new() . Am I right ?

I'll investigate my ogone module.

EDIT :
investigation done :

- the hook_order of the ogone module does virtually nothing in the $op = 'save' case.
and that's maybe the problem ?

- the uc_payment_method_ogone hook in its 'order-save' case does nothing to the uc_order table.

-the entire ogone module does not take access to the global $user object at any time, only relying on $order object passed in for user info.

hope it helps.

akamarvin's picture
Offline
Joined: 11/19/2007
Juice: 18
Re: Re: Re: authenticated user able to place an anonymous order

the problem may also come from uc_cart_complete_sale() that can optionally make an update on uc_order in the beginning of its code.

Ryan's picture
Offline
Joined: 08/07/2007
Juice: 15438
Re: Re: Re: Re: authenticated user able to place an anonymous or

Hmm... That code should actually remedy any issue where an order comes in with a 0 uid. It finds an existing user or creates a new one to attach to the order.