-
Notifications
You must be signed in to change notification settings - Fork 9.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vault/Stored Payment Methods are not saved per store #34253
Comments
Hi @lilbumblebear. Thank you for your report.
Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:
For more details, please, review the Magento Contributor Assistant documentation. Please, add a comment to assign the issue:
🕙 You can find the schedule on the Magento Community Calendar page. 📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket. 🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel ✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel |
Hi @engcom-Delta. Thank you for working on this issue.
|
any updates on this? seems like there is a security issue here with stored payments being shown on stores without the same processor credentials |
@lilbumblebear: I fail to see how this is an issue when the customer account is shared across multiple websites? |
@hostep I understand your point, however, a vault payment token should technically be tied to the customer AND store in which it was used. Sharing customer accounts across websites does not mean the websites share payment processor information. Ex: Braintree credentials are saved at the store_view level. Let's say a store owner has 2 brands, each brand has its own website. Most processors require different accounts for each of these websites in order to display the correct brand in the transaction description. The customers can order from either website, with a shared account, but cannot use the same vault tokens because they are different processor accounts. |
Hmm okay, this is pretty complex apparently and far beyond my knowledge 😄 @nathanjosiah: since this could be a potential security related issue, I'm including you here, but if you're not the right person, feel free to include people in here that know more about this functionality. |
I don't think there are any security issues here. Based on the description of the problem it does look like a valid bug but I expect the only unexpected/bad behavior with this would be an error message if a token was used for a different payment account than what it was created for. CC @vkublytskyi |
Hi @engcom-November. Thank you for working on this issue.
|
✅ Jira issue https://jira.corp.magento.com/browse/AC-2016 is successfully created for this GitHub issue. |
✅ Confirmed by @engcom-November. Thank you for verifying the issue. |
@nathanjosiah I think there is a security issue here. Consider a case where the payment gateway gives weak / colliding tokens. This is fine, because the token means nothing to us, and the association with actual payment happens at the payment gateway side. Let's say (for ease of discussion here) that the payment gateway gives sequential numeric identifiers per account as its tokens. With the above, let's follow the flow of two users in Magento using the Vault.
Another similar problem could exist if the website administrator changes the payment gateway account credentials. For example (following on from above):
From what's being described here, no collisions have been detected so far. (This is most likely because payment gateways are likely producing globally unique tokens.) When there's no collision, the payment gateway is rejecting the token and the user gets an error. Yes, the token belongs to the user, but also to the payment method / gateway account. When these match what's on the store being visited, the Vault payment methods / options should show. When either is not applicable, the Vault payment methods should not be displayed. |
✅ Jira issue https://jira.corp.magento.com/browse/AC-2901 is successfully created for this GitHub issue. |
@sidolov why was this closed? The labels suggest that this has been 'done', but I don't see any details here about what has been changed in order to fix this. |
Hello, As I can see this issue got fixed in the scope of the internal Jira ticket AC-2901 by the internal team Based on the Jira ticket, the target version is 2.4.7-beta2. Thanks |
Preconditions (*)
Steps to reproduce (*)
Expected result (*)
Actual result (*)
Please provide Severity assessment for the Issue as Reporter. This information will help during Confirmation and Issue triage processes.
The text was updated successfully, but these errors were encountered: