Cart ID in Magento

Question

I'm working on integrating a 3rd party checkout, and discovered a security hole that i need help closing. Basically the checkout process is like this:

1.if certain conditions are met, when the customer clicks "checkout" they items in the cart get scraped and they are redirected to the 3rd party site.

2.they fill out their customer information and payment information

3.the payment is processed

4.after the payment is confirmed, they are redirected back to the merchant site

5.the order is processed programatically using the items currently in the cart and the customer receives their confirmation

6.Everybody is happy

The problem comes if someone edits the cart anytime during steps 2-4, Magento believes the new cart contents are what they paid for. This means someone could maliciously or accidentally add items of any value and get them without actually paying. Or delete items and not get them, even though they were paid for.

I'm not very familiar with how Magento saves quotes, but i'm hoping that there is a "cart ID" or something like that which represents the specific cart with its specific content, and that changes when something is added/deleted/edited in the cart. Then I can compare the number from when they left, to the number when they get back and make sure there's no fraud. Basically my worry is that even when they change items, the ID number i'm sending, getting back, and using to compare will remain unchanged.

So my questions are:

-Is there such a number?

-Where is it stored and how is it retrieved?

-Can it simply be loaded based on the number to repopulate the cart with the items in there at the time they were redirected to the 3rd party?

-If my plan won't work, why and is there a better way?

Thanks for the help guys. I wouldn't be able to get through all this without the answers here.

Answer 1

Just before you re-direct the customer to the third party page set the quote object's is_active property to 0. This would reflect in sales_flat_quote.is_active field. This would make the quote inactive and the user wouldn't be able to edit the quote in another tab or anything like that.

Before the redirect you would have to do something like:

$quote = Mage::getSingleton('checkout/session')->getQuote();
$quote->setIsActive(false);
$quote->save();

This is also how Magento handles this kind of functionality be default. It makes the quote inactive just around the time it creates an order and is ready to redirect the customer to a payment gateway.

For core check it out in:

Mage_Sales_Model_Service_Quote::submitOrder() it makes a call to _inactivateQuote() right after it saves the transaction on order object.