[Issue] PayPal payment processed twice

[PatrickRQ]

Hi IPS,

I somehow connect it with recent changes/updates to PayPal API, as for years we never experienced such issue, however I may be wrong.

Using 4.7.10, customer reported us that payment was processed twice, indeed. When checked PayPal we had two payments, each under different transaction ID, one processed and one pending.

I attach logs for each of logged transactions/issues:

The URL of page the error occurred on was https://mydomain.com/checkout/29605/?_step=checkout_pay
RuntimeException::0

#0 /srv/www/public_html/applications/nexus/sources/Gateway/PayPal/PayPal.php(328): IPS\nexus\Gateway\_PayPal->_paypalAuth()
#1 /srv/www/public_html/applications/nexus/modules/front/checkout/checkout.php(1560): IPS\nexus\Gateway\_PayPal->auth()
#2 /srv/www/public_html/init.php(932) : eval()'d code(50): IPS\nexus\modules\front\checkout\_checkout->_pay()
#3 /srv/www/public_html/applications/nexus/modules/front/checkout/checkout.php(170): IPS\Helpers\_Wizard->__toString()
#4 /srv/www/public_html/system/Dispatcher/Controller.php(118): IPS\nexus\modules\front\checkout\_checkout->manage()
#5 /srv/www/public_html/applications/nexus/modules/front/checkout/checkout.php(57): IPS\Dispatcher\_Controller->execute()
#6 /srv/www/public_html/system/Dispatcher/Dispatcher.php(153): IPS\nexus\modules\front\checkout\_checkout->execute()
#7 /srv/www/public_html/index.php(13): IPS\_Dispatcher->run()
#8 {main}

The URL of page the error occurred on was https://mydomain.com/checkout/29605/?_step=checkout_pay
RuntimeException::0

#0 /srv/wwwpublic_html/applications/nexus/sources/Gateway/PayPal/PayPal.php(328): IPS\nexus\Gateway\_PayPal->_paypalAuth()
#1 /srv/wwwpublic_html/applications/nexus/modules/front/checkout/checkout.php(1560): IPS\nexus\Gateway\_PayPal->auth()
#2 /srv/wwwpublic_html/init.php(932) : eval()'d code(50): IPS\nexus\modules\front\checkout\_checkout->_pay()
#3 /srv/wwwpublic_html/applications/nexus/modules/front/checkout/checkout.php(170): IPS\Helpers\_Wizard->__toString()
#4 /srv/wwwpublic_html/system/Dispatcher/Controller.php(118): IPS\nexus\modules\front\checkout\_checkout->manage()
#5 /srv/wwwpublic_html/applications/nexus/modules/front/checkout/checkout.php(57): IPS\Dispatcher\_Controller->execute()
#6 /srv/wwwpublic_html/system/Dispatcher/Dispatcher.php(153): IPS\nexus\modules\front\checkout\_checkout->execute()
#7 /srv/wwwpublic_html/index.php(13): IPS\_Dispatcher->run()
#8 {main}

Edited June 12, 2023 by PatrickRQ

[Marc Stridgen]

Before we go any further, could you you check if you are potentially running more than one instance? Perhaps running a test copy of your site somewhere? 

[PatrickRQ]

I have test copy, under different sub-domain/database. The member/customer that processed the payment does not exist in the copy, as the copy was taken half year ago and I just use it to test updates. For years I use IPB I never had double payment issue, so I somehow connected it potentially with recent PayPal API updates on your end.

FYI, cron task URL is properly adjusted for needs of the test copy, if that's what were you seeking for.

Edited June 13, 2023 by PatrickRQ

[Marc Stridgen]

We would need to look further into this for you, however the access details on file appear to be incorrect or missing. Could you please update these details by visiting your client area, selecting the relevant purchase, then clicking "Review/Update Access Information" under the "Stored Access Information" section. 

We look forward to further assisting you. 

This said however, the checkout process requires the user to log in and confirm the payment. The only way a payment can be taken twice is to actually login and pay twice

 

Its worth noting there is a hook running in that process too, so it would be worth disabling that while testing

 

[PatrickRQ]

User is from China, using proxy, said had network issues during processing the payment, so it possibly could be processed twice, however - processed on same order. There should be some protection against such situations anyway.

There is no trace of doubled payment in IPB except the logs I provided. Order had assigned first transaction ID and the other transaction was visible only in PayPal.

PayPal itself detected something could be wrong and marked the transaction pending, so I had to confirm it (collect) or cancel (refund).

Edited June 13, 2023 by PatrickRQ

[Marc Stridgen]

Have you checked on paypal on your own end there? I ask as he would have to have had authorised both payments. Paypal simply wont let you pay without this

[PatrickRQ]

I just told you. There were 2 payments from same second, both in my PayPal. One was processed, completed (the one assigned to the order on Commerce side) and other one was Pending, requiring my action, to claim or refund the payment. This is how it was handled by PayPal. Both were authorized, but PayPal itself detected something is wrong so I had to either confirm or refuse the second payment. Still no sign of it on IPS end except doubled log entry I assumed is related to the issue.

[Stuart Silvester]

In the developer portal on PayPal, can you get the two(or so) related API call logs for this transaction (event logs > api calls). - Feel free to send them via PM.

The exception is something we need to look into, but I don't see how a payment could be processed twice. With PayPal, the customer has to click a button to redirect to PayPal, then they have to sign in and then they have to click another button to confirm the purchase.

[PatrickRQ]

The initially mentioned error started to appear very often, people report they are unable to pay and must try using different PayPal account

And nothing special/relevant in PayPal API call/error logs. If you want to review yourself you can join me via e.g. TeamViewer and check what you need yourself. Just let me know.

[Stuart Silvester]

On 6/17/2023 at 8:16 AM, PatrickRQ said:

And nothing special/relevant in PayPal API call/error logs

With due respect, that's something we need to determine. Looking at your stack trace, the response isn't what we're expecting so I would like to see what's different with that response. The logs I want to see will be sent to the 'checkout/orders' endpoint.