Payment method Zero Subtotal Checkout hack

Question

In one of our Magento stores we were receiving orders with payment method 'Zero subtotal checkout' or as it says in the order grid 'No payment information required'. But actually the orders had a subtotal larger than zero, order amounts were up to € 500,-.

In the logs, we found these orders were pushed to Paypal somehow, but were never paid.

After some digging we found out what was happening.

In the checkout, open up your browser code inspector and change the input for for example Paypal:

<input id="p_method_paypal_standard" value="paypal_standard" name="payment[method]" title="PayPal" class="radio validate-one-required-by-name" type="radio">

To:

<input id="free-payment-method" value="free" name="payment[method]" title="PayPal" class="free validation-passed" type="radio" checked="checked">

Then click Finish Order, you'll end up at Paypal, you just close that screen. The order is already in Magento with status No payment information required, and in our case Processing, which normally is the sign for 'OK, let's ship this'.

So we thought of the following solutions:

• Disable the payment method Zero Subtotal Checkout. But we need to have the Zero subtotal checkout payment enabled, because we use store credit and some coupon codes with 100% discount, so it's necessary to have this one enabled.
• Set the New Order status to Pending. This prevents the order from being shipped, but of course this also goes for orders that are legitimate.

For now we have chosen the latter.

What would be a better solution? Can this be prevented somehow, while maintaing the Zero Subtotal Checkout functionality?

Answer 1

I'm sorry that I can't comment on it [I don't have enough rep]. Are you sure, that hack works?

because, zero subtotal checkout won't work with subtotal greater than zero (it is coded like that).

so if, it is happening, you must have made changes to that functionality, which sets grand total to zero, but not in the quote object exactly.

i.e. either your customization or any other custom extension modified the grand total in a way that it should not be done.

Answer 2

There is never been such situation with standard Magento configuration, maybe your magento core or payment methods code was changed, or you are using non-standard 3rd party extension. First of all free payment method is used when quote grand total equal 0. See /app/code/core/Mage/Payment/Model/Method/Free.php

protected $_code = 'free';

/**
 * Check whether method is available
 *
 * @param Mage_Sales_Model_Quote|null $quote
 * @return bool
 */
public function isAvailable($quote = null)
{
    return parent::isAvailable($quote) && !empty($quote)
        && Mage::app()->getStore()->roundPrice($quote->getGrandTotal()) == 0;
}

Second you can choose "pending" order status via payment config. Go to admin->system->config->payment methods and open "Zero Subtotal Checkout" method. Change "new order status" to "Pending" and save.