Commerce Allows User to Edit Cart After Completion of Checkout

Question

I recently found a problem where a customer can edit their cart and re-checkout after checkout has been completed and payment has been made. This results in a single order record (the latter one) and two payments.

Re-creation of this issue: 1. Start a cart 2. Open the cart in a second window (You should have two windows/tabs open with the same cart) 3. Checkout on the first screen 4. Once checkout is completed and payment has been made, remove or update an item in your cart using the second screen

This places the cart back in a Shopping Cart status (per Drupal Commerce rules) and you have the same order/cart number since they share a table (which is another problem for another day). You can now checkout again and you will have two order confirmation emails with the same order number. Drupal Commerce will show only one order (the second order) but two payments. There is no way to recover the first order.

This only happens when the customer leaves the shopping cart open in multiple window(s) and tries to edit it after checkout.

Is there a fix to dis-allow editing of a cart after it changes over to an order? I would like it to throw an error and force a refresh of the page causing it to create a new shopping cart.

Answer 1

Hmmm, this is definitely something that deserves to be fixed in Commerce itself. I'm going to open an issue there and outline a strategy that essentially adds a form alter hook to the Cart module to redirect back to /cart in the event that the shopping cart form is being built / submitted for an order that is in an unsupported status. I can't say exactly how I'd do it yet, but I suppose it would involve iterating through the checkout pages to allow shopping cart form submissions for any order that hasn't yet passed a checkout page that doesn't have back buttons (e.g. the Payment and Completed pages).