When an admin makes an order on behalf of a user, that order can get connected to a wrong user due to using a previously saved stripe ID.

---
I have had reports of the Stripe Receipt being sent to the wrong customer, and in my Stripe account, the email on the payment does not match the email on the ubercart order.

All of my orders are anonymous, so no user is saved or created when they checkout, and so there is no way for uc_stripe to save a stripe ID to a user account - could this be the cause?

Comments

Collins405 created an issue. See original summary.

Collins405’s picture

Collins405 commented
Priority: Normal » Major

Marking as major as potential data protection issue with order details being sent to wrong customer.

Collins405’s picture

Collins405 commented

I can see a Payment Method getting stored in a session.

If my client had taken payment from one customer over the phone - then taken payment from a separate customer over the phone and that SESSION was still active, would it have used the first clients payment method on the new customer?

Collins405’s picture

Collins405 commented
Priority: Major » Normal

OK i found the issue.

This is due to the Stripe ID being saved on the user object.

For us, this is a big issue as the logged in user is not tied to a single Stripe account - they can be processing may cards on behalf of the customer.

For the moment, I have made the _uc_stripe_get_payment_id() and _uc_stripe_get_customer_id() functions both return false.

I have also adjusted the checkout complete hook to stop the data being saved on the user account.

I think we should add this as a option in the Stripe settings to stop the data being added to the user account.

andraeray’s picture

andraeray commented

Thanks for this Collins.

I believe the module and possibly ubercart assumes that a customer account will always be created on the drupal side. A check possibly has to be done to see if one is actually created or not.

I don't know the consequence of your your temporary fix of making _uc_stripe_get_customer_id and _uc_stripe_get_payment_id return false. You might end up not being able to check out properly, or multiple users on the stripe.

---edit ---
On second thought, setting _uc_stripe_get_customer_id to false all the time will force a new stripe user to be created each time and save that new stripe id to your customer oject. That should fix your problems. I'm not sure consequence of setting _uc_stripe_get_payment_id to false.

2.x used to create a new stripe user each time, but that behavior was changed based on discussions with stripe and some errors with recurring payment and check payment intents.

andraeray’s picture

andraeray commented

Collins please tell me more about your use case.

You guys have a drupal account that will make orders on behalf of other customers, and those customers may never have a drupal account?

andraeray’s picture

andraeray commented

I'm asking because possibly creating an admin interface to process orders might be the answer. Because as per stripe those types of orders are different than an actual customer making the order in relation to SCA.

Collins405’s picture

Collins405 commented

Thanks Andrae,

Yeah that's right, so it's now creating a new customer every time which is fine with me.

We don't use the recurring functionality and we've added a load of other stuff in for meta data and line items and platform text so I've actually forked the module for our own use and will be applying patches to other things as they come.

If the default behaviour is that a user gets created then this probably won't apply to anyone else and you can ignore me :-)

Ive got a virtual terminal already which I will be looking into stripes Moto transaction for customer not present charges

andraeray’s picture

andraeray commented

Okay I see. Thanks for letting me know. I appreciate the tickets.

I'll leave this open to see if anyone else is experiencing the problem.

I am planning to add a api hook so that the charge/paymentIntent params can be changed having to modify the module code. I have this requirement for my project as well. #3079310: Create API function to allow modifying of Charge params

Hopefully this can help your code stay close to the uc_stripe code so that you can still contribute.

andraeray’s picture

andraeray commented
Title: Receipt Sent to Wrong Customer » Admin orders can get associated with the wrong user.
andraeray’s picture

andraeray commented
Issue summary: View changes