Prestashop 1.6退房时的金额篡改
I have a shopping cart built in Prestashop 1.6 and I have integrated HDFC Payment Gateway in it . After an security audit the bank told me "The test found one high-risk vulnerability (i.e. Amount Tampering)". Resolution- Kindly maintain the session.
I had not coded anything as Prestashop 1.6 is in built CMS and neither did i do anything with the HDFC payment gateway as they provided a pre built code from their end which is developed using Prestashop 1.6. I just installed the module from backend.
The Problem
- Added one item to the cart and checked out. (eg - 400 USD)
- On the 3rd party hdfc payment gateway page i didn't process with the payment.
- Opened another tab and added few more items (eg - 400 USD + 300 USD)
- Now back to point 2 and i processed with the amount for 400 USD and paid.
- In my admin panel its showing paid for 400 USD + 300 USD and two items are bought by the customer .
I have no idea how to solve this Amount related issue.
I am a newbie in Prestashop and Payment Gateway Integration.
我在Prestashop 1.6中安装了购物车，并在其中集成了HDFC支付网关。 在进行安全审核之后，银行告诉我“测试发现了一个高风险漏洞（即金额篡改）”。 Resolution- Kindly维持会话。 p>
我没有编写任何内容，因为Prestashop 1.6在内置CMS中，我也没有对HDFC支付网关做任何事情，因为他们提供了使用Prestashop 1.6开发的预编译代码 。 我刚从后端安装了模块。 p>
问题 p>
- 将一个项目添加到购物车并签出。 （例如 - 400美元） li>
- 在第三方hdfc支付网关页面上，我没有处理付款。 li>
- 打开另一个标签并添加更多项目（ 例如 - 400美元+ 300美元） li>
- 现在回到第2点，我处理了400美元并支付了金额。 li>
- 在我的管理面板中显示付款 400美元+ 300美元，客户购买两件商品。 li>
ol>
我不知道如何解决这个与金额相关的问题。 p>
我是Prestashop和支付网关集成的新手。 p> div>
The best practice with payment processing is always to double-check that the amount sent back by the bank after the payment was processed is perfectly matching with the amount of the related shopping cart in your local (PrestaShop) database.
Here's a simplified flow chart:
In case you do not have programming skills, I would suggest to kindly refer to the module's developer so he/she can address that security issue.