{"action":"created","issue":{"url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/1089","labels_url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/1089/labels{/name}","comments_url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/1089/comments","events_url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/1089/events","html_url":"https://github.com/nopSolutions/nopCommerce/issues/1089","id":127858012,"number":1089,"title":"There is a security hole in PayPalStandard which can be exploited to trick NopCommerce into thinking an order has been paid in full when in fact only a 5c payment has been made.","user":{"login":"kwerty","id":1049196,"avatar_url":"https://avatars.githubusercontent.com/u/1049196?v=3","gravatar_id":"","url":"https://api.github.com/users/kwerty","html_url":"https://github.com/kwerty","followers_url":"https://api.github.com/users/kwerty/followers","following_url":"https://api.github.com/users/kwerty/following{/other_user}","gists_url":"https://api.github.com/users/kwerty/gists{/gist_id}","starred_url":"https://api.github.com/users/kwerty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwerty/subscriptions","organizations_url":"https://api.github.com/users/kwerty/orgs","repos_url":"https://api.github.com/users/kwerty/repos","events_url":"https://api.github.com/users/kwerty/events{/privacy}","received_events_url":"https://api.github.com/users/kwerty/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-21T06:44:52Z","updated_at":"2016-01-21T13:45:58Z","closed_at":null,"body":"I run an online store powered by NopCommerce. I am also a full time developer. I am running stock NopCommerce 3.7 with no modifications. I have written various plugins but these do not touch PayPal.\r\n\r\nA customer placed an order at my store for $237.75 which was showing up as Paid. However the user had only made a payment of 5c.\r\n\r\nI caught this before sending the order out because I have a plugin which integrates with my accounting/inventory system, and this plugin checks the PayPal IPN for the mc_gross/mc_fee values.\r\n\r\nYou can see from the attached pictures that the order total was $237.75 but the PDT and IPN shows a payment of only 5c.\r\n\r\n![order](https://cloud.githubusercontent.com/assets/1049196/12473527/d626431e-c077-11e5-836f-a1732b7e0435.JPG)\r\n\r\n\r\n![order notes](https://cloud.githubusercontent.com/assets/1049196/12473392/aae54228-c076-11e5-825a-136fb3133c3b.jpg)\r\n"},"comment":{"url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/comments/173574038","html_url":"https://github.com/nopSolutions/nopCommerce/issues/1089#issuecomment-173574038","issue_url":"https://api.github.com/repos/nopSolutions/nopCommerce/issues/1089","id":173574038,"user":{"login":"AndreiMaz","id":5019111,"avatar_url":"https://avatars.githubusercontent.com/u/5019111?v=3","gravatar_id":"","url":"https://api.github.com/users/AndreiMaz","html_url":"https://github.com/AndreiMaz","followers_url":"https://api.github.com/users/AndreiMaz/followers","following_url":"https://api.github.com/users/AndreiMaz/following{/other_user}","gists_url":"https://api.github.com/users/AndreiMaz/gists{/gist_id}","starred_url":"https://api.github.com/users/AndreiMaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndreiMaz/subscriptions","organizations_url":"https://api.github.com/users/AndreiMaz/orgs","repos_url":"https://api.github.com/users/AndreiMaz/repos","events_url":"https://api.github.com/users/AndreiMaz/events{/privacy}","received_events_url":"https://api.github.com/users/AndreiMaz/received_events","type":"User","site_admin":false},"created_at":"2016-01-21T13:45:58Z","updated_at":"2016-01-21T13:45:58Z","body":"Hmm. The error is logged. Hence the following code has been invoked in \\Nop.Plugin.Payments.PayPalStandard\\Controllers\\PaymentPayPalStandardController.cs:"}}