PayPal IPN update Bug with PENDING status updating Nop to PAID

Andrei, to simplify this there are only 1 thing that you need to look at and its result. The IPN that I posted in the original post is the first IPN for this order that was received from PayPal. It states that the PayPal payment status is "Pending". Nopcommerce took that IPN and as a result, updated the order in NopCommerce to "Paid".

Note this was a credit card payment, so it was using the PayPalDirect plugin, not PayPal Standard.

a.m. wrote:

So you use version 3.50 (based on this forum post). Could you please test it in the latest version of nopCommerce? Do you still experience this issue?

FYI, we had 4 orders come through overnight that this bug impacted...as a result, all 4 orders went down to our shipping system to be shipped. Luckily, we manually caught them and stopped them from being shipped.

Now onto the issue....I *think* I've found the root cause...but let me know your thoughts as we have not debugged this yet, just reading through code and came up with this hypothesis:

I reviewed the code in the

PayPalDirectController

in 3.5 and the latest version, and though I see some differences, I don't see any that would affect this issue. In fact, I don't see any code in the IPNHandler that would let this issue occur....this, coupled with the order of the notes for this order, seem to imply that for PayPalDirect, IPN is not what is updating the order and paid statuses, but rather the

AuthorizeOrSale

method.

Here are the Order Notes for this order:


It goes to Order Processing status, BEFORE the IPN is received. Though the order notes don't indicate a payment status update to paid, it must be also happening during order placed.

If you look at

PayPalDirectPaymentProcessor.AuthorizeOrSale

, you will see that the logic there will update the order PaymentStatus to Paid, so long as

bool success = PaypalHelper.CheckSuccess(response, out error);

is true.

But

PaypalHelper.CheckSuccess(response, out error)

is only checking for explicit processing errors. If PayPal was able to process the payment ok, but had fraud filter issues, this would not result in an error and as such would return true and hence mark the PaymentStatus to Paid.

What do you think?

a.m. wrote:

Image wasn't coming through on prior post. Here it is.

Thanks a lot, Chad! Please let us investigate it