Magento2: Order is associated to wrong customer

[alexgoodey]

There is a bug in how session cookies and local storage interact which has the result of exposing customer data to the wrong entities (associating a guest order to a registered customer id, assigning a quote with a customer id to a guest session)

Preconditions

1. Magento CE 2.1.2 with Sample Data
2. PHP 5.6
3. Guest checkout enabled
4. Customer registrations allowed
5. Session set to expire after 1 hour (default)

Steps to reproduce

1. Create a customer account on frontend of Magento
2. Add a product to the basket
3. Go back to home page
4. Wait 1 hour for the session to expire or delete the PHPSESSID cookie
5. Reload the homepage
6. Proceed to checkout from the mini cart
7. If you see the empty cart page, click Proceed to Checkout again from the checkout
8. Complete the checkout process as a guest (which you will be)
9. Check the order in the admin area to see if it is a guest checkout or associated to a customer

Expected result

When the session expires or the PHPSESSID is deleted:

1. Once the page is reloaded the mini cart displays no items
2. If the guest adds a product to basket a new quote is created
3. If the guest checks out a Guest order is created

Actual result

When the session expires or the PHPSESSID is deleted:

1. The mini cart shows the items that were from the logged in (expired) session
2. The existing quote in local storage is associated to the new guest session (but in the DB retains the customer_id of the previous customer)
3. When the guest checks out the new order is associated to the previous logged in customer

[olysenko]

Hi, thank you for your report. Unfortunately, I could not reproduce the issue as you described it. Please provide the detailed steps we must follow to reproduce this issue

[alexgoodey]

Ok, further investigation shows the critical part is persistent cart needs to be enabled. Steps to reproduce:

1. Install a clean Magento 2.1.2 install with sample data
2. Set "Enable Persistence" to Yes in the Magento Config section "Persistent Shopping Cart" (leave other settings as default.
3. Flush Caches
4. On the frontend, create a new account and leave the "Remember Me" tickbox checked
5. As the logged in user, add a product to the basket
6. Go to the homepage
7. Delete the PHPSESSID cookie (this is to simulate it's 1 hour expiry)
8. Refresh the homepage and the mini cart will still show items in the cart (but the user is no longer logged in)
9. Via the mini cart click "Go To Checkout"
10. You will be presented with the empty shopping cart but the mini cart still shows items
11. Click "Go To Checkout" via the mini cart again
12. This time you will end up on the checkout page.
13. Continue the normal checkout process as a Guest
14. Observer in the admin area that the created order is associated to the original signed in customer

[olysenko]

Hi, thank you for your update.Yes, this is bug. Internal issue MAGETWO-62132 was created. Specification says: guest checkout is forbidden until old long-term cookie exists

[kevin-carroll-cl]

Hello, we are also experiencing this issue on Magento 2.1.3 Enterprise with Persistent Shopping Cart enabled, though we noticed it because it can cause a bug that prevents the guest user from successfully completing checkout.

Steps to Reproduce (assuming Magento is installed and Persistent Cart is already enabled):

1. Visit site as a guest user.
2. Add a product to the cart.
3. Sign in with the remember me box checked.
4. Delete the PHPSESSID cookie.
5. Refresh the page.
6. Session will be as a guest, cart is usually empty at this point, but is sometimes pre-populated with previous session's persisted cart. If empty, add any product to cart and the cart will then contain the new product as well as the previous session's persisted cart.
7. Begin guest checkout, using an email address different than the registered customer's.
8. On selecting a payment option and clicking the 'Place Order' button an error shows stating that "An error occurred on the server. Please try to place the order again."

Investigation showed that the error is being caused because when the order is placed it is done as a guest user, but the quote object itself is saved with the persisted customer id, as a result the guest billing address details are discarded by the time that the address is validated during the placeOrder operation, resulting in a null email and producing the 'Email has a wrong format' validation warning.

Specifically:
\Magento\Checkout\Model\GuestPaymentInformationManagement::savePaymentInformationAndPlaceOrder
line 79 (call to savePaymentInformation) successfully saves the guest payment information,
line 81 (call to $this->cartManagement->placeOrder) fails due to a LocalizedException thrown from \Magento\Sales\Model\ResourceModel\Order\Address::_beforeSave because email is null.

Screen Shot with call stack and showing validation warning:

Screen Shot showing that the quote object's checkout method is guest, but customer attributes are set as if it were for a logged in customer:

This appears to be another symptom of the same problem caused by the previous customer's id and customer group being used on a guest session resulting in quotes that are using the Guest Checkout Process but are assigned to a customer incorrectly.

[alexgoodey]

Any update on this?

[olysenko]

@alexgoodey, unfortunately it is still unresolved

[alexgoodey]

Are there any timelines on this resolution?

You understand that this bug can expose customer data to other customers and is therefore quite a serious data protection issue?

[johnybk08]

Got the same problem with EE 2.1.6.
Steps to Reproduce (Persistent Cart is already enabled):

1. Set Persistent Shopping Cart to YES
2. Also Set Allow Guest Checkout to NO
3. Login with remember me box checked
4. Delete the PHPSESSID cookie ( or wait Session expired)
5. Add new product to cart
6. Check Quote table you can see the column customer_id associated to the original signed in customer, but another field such as customer_email is NULL. This is the reason for error msg when clicking the 'Place Order' button (Email has a wrong format).

Any Solution for this one ?

[yosefkurniawan]

Got the same problem. any workaround?

[david-fiaty-cko]

+1
Is there any update on this issue?

[bwilmus]

Hi,
We do have the same problem with Magento ver. 2.1.2
I am so surprised that nothing has been done since 2 Dec 2016

If it can help, we have been asking the email/password of a client (buyer) having this issue.
If we connect with his informations on 3 different computers, 2 computers see the right order information and 1 computer see "You have not orders yet" message.

In the database everything seems to be correct, The customer_id is linked to only one order (the right one).
In the admin panel, there is no problem neither.

So the problem seems to be linked only to this path: /sales/order/history/

Regards,

Bernard

[carylewis]

We are seeing this as well, but we don't allow guest checkout, and it appears as though other sessions' cart items are being added to the customer's cart (or maybe the customer who is logging in's items are being added to another cart).

Either way, this is a critical bug.

[magento-engcom-team]

@alexgoodey, thank you for your report.
The issue is already fixed in 2.2.0

[AlexanderHuyghebaert]

@magento-engcom-team : It is not because this is fixed in 2.2.0 that the older versions don't get the solution!
Can you tell us what the solution is, because we are facing this too!

[david-fiaty-cko]

+1

[magento-engcom-team]

@AlexanderHuyghebaert @david-fiaty-cko
According to our records commit which is fixing the issue is 8db59122f48e343587cc6318b34455661e27d3b4

[AlexanderHuyghebaert]

@magento-engcom-team : thank you for your answer, will look into that and test this

[mgeoffray]

Hi,
we have got the problem on 2.1.6 EE too. We decide to disable "Persistent Shopping Cart" and "Allow Guest Checkout" but the problem is still there one day after.
I think this is because people still have their cookie and local storage even if the features are disabled.
Did you confirm that disabling this two features solve the issue, and does my thinking make sens?
Thank you.
Matthéo.

[tonybrown85]

I'm experiencing a very similar issue where the customer's email address is not present at all in the address object. This only happens with Guest checkout. I get the following error message after clicking the place order button:

We can't save the address: Email has a wrong format

The fix which @magento-engcom-team has provided only applies to Magento 2.2 as that file doesn't exist in Magento 2.1.

@magento-engcom-team Do you know if there is a fix for Magento 2.1 please?

Kind regards,
Tony

[carylewis]

My team has observed a number of strange behaviours with Magento ee 2.1.9:

items added to a cart after a user's logged in session has expired, but
without refreshing the product page - this 'guest' quote can't be checked
out due to 'email address can't be saved'.

items added to a cart as a guest do not always get converted corrected to
the user's cart when they user logs in.

items added in previous guest sessions suddenly are added to the user's
cart at login or get added to cart after checkout.

The are no consistent ways to definitively reproduce all of these issues.

The right thing to do is to upgrade to 2.2, but without being able to
reproduce the issues, it's hard to prove that 2.2 fixes them.

On Fri, Nov 3, 2017 at 5:57 AM, tonybrown85 [e-mail]
wrote:

I'm experiencing a very similar issue where the customer's email address
is not present at all in the address object. This only happens with Guest
checkout. I get the following error message after clicking the place order
button:

We can't save the address: Email has a wrong format

The fix which @magento-engcom-team
https://github.com/magento-engcom-team has provided only applies to
Magento 2.2 as that file doesn't exist in Magento 2.1.

@magento-engcom-team https://github.com/magento-engcom-team Do you know
if there is a fix for Magento 2.1 please?

Kind regards,
Tony

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/magento/magento2/issues/7665#issuecomment-341660677,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABkAvdHIxCbzOddbMh_QGrDhz2wJRL8Zks5syuOKgaJpZM4LCeE6
.

[forwells]

@carylewis Is there any new progress in the issue of email not being saved?