When a user arrives at the order/%/thankyou page, they can refresh the page as many times as they like and it will resend the order confirmation emails every time.

In addition to this, the user can change the order id in the path and resend the confirmation emails for any order they like!

I'm working on a fix for this for my client - I will post a patch when I have finished.

CommentFileSizeAuthor
#1 tweak-thankyou-callback-to-prevent-multiple-refreshes-1170632-1.patch1.65 KBandymantell

Comments

andymantell’s picture

andymantell commented
Status: Active » Needs review
StatusFileSize
new tweak-thankyou-callback-to-prevent-multiple-refreshes-1170632-1.patch1.65 KB

I have made a patch to fix this functionality. Looking at the default implementation of uc_cart_checkout_complete() in uc_cart.pages.inc I have carried across the use of $_SESSION['cart_order'] followed by checking if the $order object is empty before completing the sale. uc_cart_complete_sale() empties out the order session variable thereby ensuring that this callback only gets run once.

In addition uc_cart_complete_sale() empties the cart, so I have removed the additional call to uc_cart_empty().

md2’s picture

md2 commented

Tested the patch from #1 and can confirm it fixes the issue.

Deimos-dupe’s picture

Deimos-dupe commented

I've also applied this patch and it seems to work fine. Orders are coming through as expected and I'm unable to cause repeat emails to be sent.

andymantell’s picture

andymantell commented
Status: Needs review » Reviewed & tested by the community
leo pitt’s picture

leo pitt commented
Assigned: Unassigned » leo pitt

Thanks - I have added this patch to the dev version, please try it out.

dwigglesworth’s picture

dwigglesworth commented

I have also applied patch #1 and found the re-sending of order confirmation emails has been prevented for the the order/%/thankyou page.

leo pitt’s picture

leo pitt commented
Status: Reviewed & tested by the community » Fixed

Fixed in 6.x-1.5

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.