Payment profiles from disabled add-ons are still available for use

Affected version
2.1.12, 2.2.4

NikitOS

Active member
Hello

When an addon that adds a payment provider is disabled, the following bugs occur:
  • A payment profile can still be added/edited by using the provider/profile ID in the link.
  • The payment profiles associated with the provider of this addon can still be used. Of course, this bug is in Purchasable, out of the box it is in UserUpgrade :: getPurchaseFromRequest - it does not check if the provider's addon is active here. This is also copied by some third-party add-ons.
    I would add an active getter, which, in addition to checking if a specific profile is active, would also check if the provider's addon is active.
  • If a payment profile was selected, for example, to upgrade a user, and then the provider's add-on was disabled, options without text with the ID of “unavailable” profiles appear in the payment profile selection form:
    Снимок экрана от 2021-04-15 23-35-14.png

Regards
 
Top