If a user clicks the "update" link in their recurring fees table, then decides not to make any changes and clicks Cancel instead of Update, they get access denied because the cancel link redirects to the admin view of recurring fees, not back to the user view. This is with the authorize.net handler, the URL in question is like the following:

example.com/user/226/recurring/44/update/authorizenet_cim?destination=user/226/recurring-fees

Here's how I resolved it in uc_recurring.uc_authorizenet.inc around lines 140-147:

  $form['submit'] = array(
    '#type' => 'submit',
    '#value' => t('Update'),
   // '#suffix' => l(t('Cancel'), 'admin/store/orders/recurring/view/fee/' . $rfid),
    '#suffix' => l(t('Cancel'), $_SERVER['HTTP_REFERER']),
   
  );

Any thoughts? I'm afraid I haven't figured out how to make a functional patch yet...

CommentFileSizeAuthor
#3 cancel_charge-#1353762-#3.patch919 bytesJohnMatta
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mcarbone’s picture

mcarbone CreditAttribution: mcarbone commented
Title: cancel link on "update account details" page (Authorize.net handler) doesn't redirect correctly for customers. » Multiple cancel links don't redirect correctly
Priority: Minor » Normal

I'm actually finding that cancel URLs are broken throughout the code (when charging, when editing a recurring fee, etc.), and often mistakenly are using request_uri() instead of $_SERVER['HTTP_REFERER']. But I'm also finding that $_SERVER['HTTP_REFERER'] doesn't always play nicely with the overlay module.

phen’s picture

phen CreditAttribution: phen commented

According to the php manual, we shouldn't necessarily be using HTTP_REFERER either, so I guess a more robust solution is required.
(from http://php.net/manual/en/reserved.variables.server.php)

'HTTP_REFERER'
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

JohnMatta’s picture

JohnMatta CreditAttribution: JohnMatta commented
Issue summary: View changes
FileSize
cancel_charge-#1353762-#3.patch919 bytes

I used the Using $_SERVER['HTTP_REFERER'] the cancel after charge button works when on page, but closes the overlay otherwise, instead of partial path or complete error page