I'm working on integrating a 3rd party checkout, and discovered a security hole that i need help closing. Basically the checkout process is like this:

1.if certain conditions are met, when the customer clicks "checkout" they items in the cart get scraped and they are redirected to the 3rd party site.

2.they fill out their customer information and payment information

3.the payment is processed

4.after the payment is confirmed, they are redirected back to the merchant site

5.the order is processed programatically using the items currently in the cart and the customer receives their confirmation

6.Everybody is happy

The problem comes if someone edits the cart anytime during steps 2-4, Magento believes the new cart contents are what they paid for. This means someone could maliciously or accidentally add items of any value and get them without actually paying. Or delete items and not get them, even though they were paid for.

I'm not very familiar with how Magento saves quotes, but i'm hoping that there is a "cart ID" or something like that which represents the specific cart with its specific content, and that changes when something is added/deleted/edited in the cart. Then I can compare the number from when they left, to the number when they get back and make sure there's no fraud. Basically my worry is that even when they change items, the ID number i'm sending, getting back, and using to compare will remain unchanged.

So my questions are:

-Is there such a number?

-Where is it stored and how is it retrieved?

-Can it simply be loaded based on the number to repopulate the cart with the items in there at the time they were redirected to the 3rd party?

-If my plan won't work, why and is there a better way?

Thanks for the help guys. I wouldn't be able to get through all this without the answers here.

1 Answer 1


Just before you re-direct the customer to the third party page set the quote object's is_active property to 0. This would reflect in sales_flat_quote.is_active field. This would make the quote inactive and the user wouldn't be able to edit the quote in another tab or anything like that.

Before the redirect you would have to do something like:

$quote = Mage::getSingleton('checkout/session')->getQuote();

This is also how Magento handles this kind of functionality be default. It makes the quote inactive just around the time it creates an order and is ready to redirect the customer to a payment gateway.

For core check it out in:

Mage_Sales_Model_Service_Quote::submitOrder() it makes a call to _inactivateQuote() right after it saves the transaction on order object.

  • ok that is exactly the sort of thing i'm looking for. I'll give it a try and thank you. Still curious if there is a way i could make my original plan work. edit: do i need to reactivate it before i import the order? where in the core does it do this so i can check it out, and try to understand better what's happening?
    – Matt Flamm
    Sep 10, 2014 at 8:21
  • I don't think you need to re-active it before you import the order unless you expect to make some changes to be made to it by the user on the front end.
    – Paras Sood
    Sep 10, 2014 at 8:23
  • Have added the core reference to the answer.
    – Paras Sood
    Sep 10, 2014 at 8:29
  • Had an emergancy appendectomy so it's taken me a while to get back here. I realized the problem with this option is that the redirect is happening by Java at the time they click "checkout" so I don't really have a chance to do the php stuff. Ajax maybe? I'm not sure. Any ideas how to accomplish it then?
    – Matt Flamm
    Sep 26, 2014 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.