Bug in PayPal payment processing?

[Brewhaus]

I think that there may be a bug in AC with respect to PayPal. Shortly after turning on IPN with PayPal we found that any payment going to hotsaucedepot.com would be credited to the order in brewhaus.com, as well. We figured out that it had to do with the order number. There is an additional digit on orders under hotsaucedepot.com (2111111), and if the order number on brewhaus.com is the same, less that extra lead digit (111111) then the payment is also being applied to that order. In other words, the order number shown by PayPal to be paid does not have to match exactly- if there is an extra digit in the order number paid, but the rest matches, AC will apply the payment to the order. How can we fix this, as we had to turn off IPN, so only about 1 in every 6 or 8 PayPal payments are getting applied, so we must manually check and apply most PayPal payments.

I am actually surprised that the payments apply to orders from hotsaucedepot.com at all, as the IPN was set up with the information AC provides for the brewhaus.com site (https://www.brewhaus.com/ProcessPayPal.ashx), so I did not think that hotsaucedepot.com would even pick up on the payment. And, I would expect the brewhaus.com website to ignore a PayPal payment for an order placed on hotsaucedepot.com, as the order number could not match because it would have an additional digit.

Does anyone have any thoughts? For now I think that I will turn IPN back on and just delete the PayPal payments that get mis-applied in brewhaus.com, as it is easier than confirming all PayPal payments and applying them.

[Katie]

What do you have configured in Paypal, under the Instant Payment Notification Preferences?

[Brewhaus]

The notification URL is https://www.brewhaus.com/ProcessPayPal.ashx.

[Katie]

So you are using the same Paypal account for two different stores? If the notification URL is set to brewhaus, then I'm not sure how this is supposed to work for hotsaucedepot, as it would need to have it's own IPN url established within the Paypal account.

[Brewhaus]

PayPal only allows one URL in the IPN, from what I can tell. This is why I was surprised when payments were automatically applied in the hotsaucedepot.com list. I am 95% certain that it did apply the payments in hotsaucedepot.com, anyway. We will find out with the next order from that site paid by PayPal.

Because PayPal only gives us one spot for the URL we used the brewhaus.com one, as that site takes more orders. I did not expect them to show up on hotsaucedepot.com, so that was a pleasant surprise. The bigger issue is that the orders from hotsaucedepot.com are getting applied to an order on brewhaus.com, even though the order number is not an exact match, as we have an extra digit on the hotsaucedepot.com orders. If the HSD order is 2123456 then the payment will also be applied to the Brewhaus order 123456 (ie. the same order number, just without the leading 2).

[Katie]

Rick,

You really need to use a separate Paypal account for the hotsaucedepot store.

Thanks
Katie

[Brewhaus]

That is not an option, as separating the processing would reduce the processing volume, resulting in a higher merchant discount rate from PayPal. And, really, it should not be necessary, as our order numbers are different. This should only be an issue if the two websites use the same order numbers. If order 12345 was placed on one of the sites then it would stand to reason that order 12345 on the other site (the one that the PayPal IPN points to) would have the payment applied by AC. After all, the order number would be the same.

Ultimately, AC should make sure that the order number returned by PayPal matches exactly before applying payment. Right now it appears to only require a partial match, as a payment for order 2123456 will also be applied to order 123456. If we are seeing this issue, then I would expect that others are experiencing it, but likely not noticing because the order(s) that a payment is being applied to is/are old and completed. If we are seeing the issue with six digits in the order number versus seven, then I expect that it would be the same for five digits versus six, or four versus five, etc. However, if a PayPal payment that is made for order 11000 is also being applied to order 1000, then it is likely that the website owner would not even notice because order 1000 would have been completed long before, so it simply goes without notice. Forcing AC to require an exact match on the order number should resolve that.

[Shopping Cart Admin]

The actual fix likely involves sending the IPN return URL in the original post with the transaction. I do believe that is an option that could be used, but the developers will have to chime in here.

[Katie]

Our PayPal integration, as it is, will support a single installation. It would need to be customized to make it work with multiple sites, which is sounds like it can be done. However, this integration, which also support Express Checkout and Direct Payment will make use of a Return URL. So, it's not really something that needs to be 'fixed' in the sense that it's a bug. This would need to be a customization or new feature added for the integration to work with multiple installations.

We are actually planning to do some Paypal upgrades in an upcoming release, so it might be a good time to make a suggestion using the green feedback button.

[Brewhaus]

Although being able to set PayPal up so that it would function correctly on both sites would be great, my bigger concern is still that incorrect orders are being credited with the payment. If order 2123456 is placed, order 123456 is also being credited. There is no way for me to check if 23456 is also being credited, as that order is so old that it has been deleted from the system. It does not really matter that 2123456 is placed on a different website, as it is simply not the same order number as 123456.

[Katie]

I will do some testing on the order number issue, but my test will only use a single installation since that is all we support with the current integration.

[Brewhaus]

As I mentioned, what we have is two individual websites installed on the same server. They are not linked in any way other than the fact that both use the same e-mail address for customers to submit PayPal payments to.

With that said, after turning IPN back on things appear to be working. Now, the only PayPal payments that we have received on the Hot Sauce Depot site have correlated to completed orders on Brewhaus (when removing the leading '2'), so I have to assume that whatever the issue was previously has been resolved. This is not the first such issue that we had with our Gold installation. We had a similar issue with the Contact Us page not taking after several attempts until we basically gave it a boot, and a similar issue with dynamic forwarding, but once it started functioning correctly it was fine. I will let you know if the problem arises again.

The other issue (subscription issue- viewtopic.php?f=65&t=17697) is a different story. We cannot even manually enter the e-mail addresses into the DB.