5 replies [Last post]
schaub123's picture
Offline
Bug FinderGetting busy with the Ubercode.PayPal Hero
Joined: 10/08/2007
Juice: 458
Was this information Helpful?

Is there any way to make the anonymous checkout feature not create user accounts? It seems that the only approach is not to send the email and hide the confirm of account create message from the order confirmation screen. It would be great to have no user accounts created, just order rows. I'm only saying this from a security standpoint. When users get in they have and "authenticated user" role which could give them some undesired privs. Especially if another module isn't great on checking privs. Not a big deal tho, just curious.

Any suggestions are greatly appreciated.

Christopher Schaub

Andy's picture
Offline
Administrator
Joined: 08/07/2007
Juice: 1076
Anonymous Checkout.

When we were designing Ubercart we decided that the advantages to the customer from having an account far out way the reasons not to so there is currently no way not to create an account on purchase. I do see your concerns about creating "authenticated users." I think there are a couple of solutions.

In the short term, Ubercart should have configurations for choosing to send the confirmation email and to assign a role to a user. That way you could configure Ubercart not to send the email and to create the user with a "unauthenticated" role which has no real privileges.
Would this solve your problem?
Andy

schaub123's picture
Offline
Bug FinderGetting busy with the Ubercode.PayPal Hero
Joined: 10/08/2007
Juice: 458
hmm, how about blocking users as an option

Creating an "unauthenticated" role could be risky. I'm worried about content being owned by some anon role or user. An easy tweak (since we're still alpha?) would be to have an ubercart admin toggle setting to make newly created user accounts "blocked" by default. That way, if desired, the account notification email could be supressed along with removing the order confirmation user/pass text. This in combo with creating an order-promoted role to hold these blocked users would make keeping track of them (and later purging) easy.

I guess I'm always thinking a lot about not storing user personal data for too long, unless it's necessary. No cart that I know of has a good way to purge out orders and users. Always messy. I think that every year it's a good practice to purge orders once they've been migrated to the billing system. Especially if users don't really have any function other than reviewing their past orders. I'm really thinking about data retention stuff and privacy.

It's part of a bigger discussion about shopping carts vs billing systems. Quickbooks makes a great low-end billing system for a small ecommerce site. Most shopping carts get lost at some point trying to offer reporting and features that really belong in a billing system. Many store owners make the mistake of confusing a shopping cart with their all-in-one financial system. Always a bad idea.

Whew, so my comments about creating users in Drupal really stem for a desire to make the shopping cart very lean, not creating users that don't do much. Also being privacy stingy by default.

Anyway, what about just making an admin setting, maybe right below the "send e-mail notification of new account" which says "make users blocked by default" to prevent login and password retrieval.

Ok, thanks for your input. Good stuff in ubercartland.

Christopher Schaub

Ryan's picture
Offline
Joined: 08/07/2007
Juice: 15438
Re: hmm, how about blocking users as an option

I added a feature a while back and documented it in the configuration handbook today that lets you specify new user accounts as blocked when they come in. This will let you prevent these automatically generated accounts from ever even being able to login. Just posting this here in case you missed it and so I can remove this from my "threads to review" list. Eye-wink

dirkca's picture
Offline
Joined: 11/19/2007
Juice: 2
No useraccounts required?

I am too wondering if it was possible to have purchases done wthout the need of creating accounts. I am using the paypal express checkout and I am finding that people just want to get the order done asap.

Ryan's picture
Offline
Joined: 08/07/2007
Juice: 15438
Re: No useraccounts required?

That's exactly what anonymous checkout is for. You won't have to do anything to your install for this to happen.