Magento – Payment method Zero Subtotal Checkout hack

checkoutpayment

In one of our Magento stores we were receiving orders with payment method 'Zero subtotal checkout' or as it says in the order grid 'No payment information required'. But actually the orders had a subtotal larger than zero, order amounts were up to € 500,-.

In the logs, we found these orders were pushed to Paypal somehow, but were never paid.

After some digging we found out what was happening.

In the checkout, open up your browser code inspector and change the input for for example Paypal:

<input id="p_method_paypal_standard" value="paypal_standard" name="payment[method]" title="PayPal" class="radio validate-one-required-by-name" type="radio">

To:

<input id="free-payment-method" value="free" name="payment[method]" title="PayPal" class="free validation-passed" type="radio" checked="checked">

Then click Finish Order, you'll end up at Paypal, you just close that screen. The order is already in Magento with status No payment information required, and in our case Processing, which normally is the sign for 'OK, let's ship this'.

So we thought of the following solutions:

  • Disable the payment method Zero Subtotal Checkout. But we need to
    have the Zero subtotal checkout payment enabled, because we use store
    credit and some coupon codes with 100% discount, so it's necessary to
    have this one enabled.
  • Set the New Order status to Pending. This prevents the order from being shipped, but of course this also goes for orders that are legitimate.

For now we have chosen the latter.

What would be a better solution? Can this be prevented somehow, while maintaing the Zero Subtotal Checkout functionality?

Best Answer

I'm sorry that I can't comment on it [I don't have enough rep]. Are you sure, that hack works?

because, zero subtotal checkout won't work with subtotal greater than zero (it is coded like that).

so if, it is happening, you must have made changes to that functionality, which sets grand total to zero, but not in the quote object exactly.

i.e. either your customization or any other custom extension modified the grand total in a way that it should not be done.

Related Topic