OpenCart Community

DANDTON wrote: ↑

Tue Apr 20, 2021 8:58 pm

Hello everyone,
I am useing 3.0.3.2, today I found a problem, when I finish buying by paypal and click "return back" button on paypal page, then the page go to my store.
BUT, the buyer account sign out automaticly, I must login again. BUT when I login again, I can see the shopping cart is not clear......
I can see that: All my google chorme's cookies is sign out automaticly, my admin account in another lable is sign out automaticly too.....
I use Journal 3.1.8.
Thank you for your help!!
Yours, Daniel

JNeuhoff wrote: ↑

Tue Apr 20, 2021 10:31 pm

Not an OpenCart bug, the OpenCart checkout eventually reaches the checkout/success page, and the user stays logged in, but with the shopping cart cleared after the successfully processed order. Journal3 is a different framework (80% non-Opencart) so in your case you will have to get in touch with the Journal support.

DANDTON wrote: ↑

Thu Apr 22, 2021 11:25 am

Called paypal, and got no answer, so I tried to test more and find the resolution:
1.Must update PHP7.0 to PHP7.3, after test, only PHP7.3 is ok
2.edit document: /upload/system/framework.php around 110 line

//original cookie
//setcookie($config->get('session_name'), $session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($config->get('session_name'), $session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

3.edit document: /upload/catalog/controller/startup/session.php around 25 line
//original cookie
//setcookie($this->config->get('session_name'), $this->session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($this->config->get('session_name'), $this->session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

refresh ocmod, done,
Now test, after checkout and return back to sucessul pay page, the customer won't logout and the shopping cart is empty.

frasergoconsultme wrote: ↑

Mon May 15, 2023 11:40 pm

DANDTON wrote: ↑

Thu Apr 22, 2021 11:25 am

Called paypal, and got no answer, so I tried to test more and find the resolution:
1.Must update PHP7.0 to PHP7.3, after test, only PHP7.3 is ok
2.edit document: /upload/system/framework.php around 110 line

//original cookie
//setcookie($config->get('session_name'), $session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($config->get('session_name'), $session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

3.edit document: /upload/catalog/controller/startup/session.php around 25 line
//original cookie
//setcookie($this->config->get('session_name'), $this->session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($this->config->get('session_name'), $this->session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

refresh ocmod, done,
Now test, after checkout and return back to sucessul pay page, the customer won't logout and the shopping cart is empty.

Had the same issue and this worked for me...many thanks :-)

ADD Creative wrote: ↑

Tue May 16, 2023 7:48 am

frasergoconsultme wrote: ↑

Mon May 15, 2023 11:40 pm

DANDTON wrote: ↑

Thu Apr 22, 2021 11:25 am

Called paypal, and got no answer, so I tried to test more and find the resolution:
1.Must update PHP7.0 to PHP7.3, after test, only PHP7.3 is ok
2.edit document: /upload/system/framework.php around 110 line

//original cookie
//setcookie($config->get('session_name'), $session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($config->get('session_name'), $session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

3.edit document: /upload/catalog/controller/startup/session.php around 25 line
//original cookie
//setcookie($this->config->get('session_name'), $this->session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($this->config->get('session_name'), $this->session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

refresh ocmod, done,
Now test, after checkout and return back to sucessul pay page, the customer won't logout and the shopping cart is empty.

Had the same issue and this worked for me...many thanks :-)

That's not the best way to fix the issue for PayPal Standard. You can just change the rm variable to 1, as done in 3.0.3.8.
https://github.com/opencart/opencart/pull/8072

That way you can keep using default SameSite=Lax, which would give more protection against attacks such as CSRF. Which is probably important if you are using an older version than 3.0.3.8 that does not have the security vulnerability in the PayPal Standard extension patched.

frasergoconsultme wrote: ↑

Tue May 16, 2023 9:09 pm

I am running 3.0.3.8 and was still having the issue until I changed the code as above.

<input type="hidden" name="rm" value="1" />

DANDTON wrote: ↑

Thu Apr 22, 2021 11:25 am

Called paypal, and got no answer, so I tried to test more and find the resolution:
1.Must update PHP7.0 to PHP7.3, after test, only PHP7.3 is ok
2.edit document: /upload/system/framework.php around 110 line

//original cookie
//setcookie($config->get('session_name'), $session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($config->get('session_name'), $session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

3.edit document: /upload/catalog/controller/startup/session.php around 25 line
//original cookie
//setcookie($this->config->get('session_name'), $this->session->getId(), ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'));

//modified cookie
setcookie($this->config->get('session_name'), $this->session->getId(), ['expires' => ini_get('session.cookie_lifetime'), 'path' => ini_get('session.cookie_path'), 'domain' => ini_get('session.cookie_domain'), 'samesite' => 'None', 'secure' => true, 'httponly' => true]);

refresh ocmod, done,
Now test, after checkout and return back to sucessul pay page, the customer won't logout and the shopping cart is empty.

kslakhani wrote: ↑

Fri Jul 28, 2023 1:03 am

Thanks, worked perfectly on OC v3.0.2.0