1

I hope someone can help me. I've been working on a site using Exp:resso store 1.6.4 and EE 2.6.0. I've just finished the dev process, but while I've been busy doing that, EE has updated and so has Store. I thought I'd upgrade them both now before the site goes live, so I've just patched to Store 1.6.5 and EE 2.7.2. (I've got backups).

Everything seems to work ok until I return from eWay's shared payment page.

EE gives a vague error: The action you have requested is invalid.

This is when trying to process index.php?ACT=34&H=e6afaea42c9d67163422a8e039274f83.

From what I've read I believe could be a security issue? I've found nothing specificto help solve, however.

Note that at present I am running the dev server without an SSL, and this was not a problem until now. Store is set to NOT require SSL connection.

I also note that the payments are processed and completed at eWay, but the order is never recognised in Store, and my cart still contains the ordered items.

Here's my cart tag:

{exp:store:checkout payment_method="eway_shared" return="checkout/confirm/ORDER_HASH" require="accept_terms" error_handling="inline" error_delimiters='<span class="error">|</span>'}

Any help much appreciated.

Improve this question
2
  • Seems I can get around this by unchekcing EE's security setting Process form data in Secure Mode? Seems I can do this for now, then once I have the SSL setup, turn both that and Store's own secure mode flag on?
    – Dan P
    Oct 23, 2013 at 21:22
  • Form secure mode actually has nothing to do with SSL. Though it's ideal to leave it enabled, it's not any risk to your ecommerce activities to have it disabled. I imagine if you update Store to the newest version, it will work with secure mode enabled.
    – Jeremy Gimbel
    Oct 24, 2013 at 1:31

2 Answers 2

Reset to default
3

You need to disable secure forms (in the control panel under Admin > Security & Privacy > Security and Sessions, set "Process form data in Secure Mode?" to "No")

Some changes made in EE 2.7 have made the secure forms feature a nightmare to work with, and on most sites it causes more trouble than it is worth (for example, back button is totally broken with form submissions, AJAX submissions are overly difficult to work with, and requests from third party servers like eWay are blocked entirely). The easiest solution is just to disable secure forms for the time being. We're talking to Ellislab about this but it is unclear at this stage whether they will revert the change in a future version of EE.

Improve this answer
2
  • Thanks for the answer Adrian, I've been running into similar troubles with Freeform pro multi-page forms where the back button is completely broken because of this "feature". Thnx!
    – erwinheiser
    Jan 29, 2014 at 12:51
  • Unfortunately it looks like Ellislab aren't going to revert this, so we are stuck with it for the time being. In Store 2.2 we use the ee()->security->restore_xid() method to explicitly allow form resubmissions where it's not a problem (like multi-page forms), so Freeform should probably do the same thing.
    – Adrian Macneil
    Jan 29, 2014 at 20:01
0

Secure forms isn't protocol aware, so the SSL cert doesn't come into play. The role of secure forms is to check that the submission originated from a form on this site and no more than once.

Without setting up a test install it's hard to tell you exactly what would need to be changed in order to support secure forms. That said, there should be no issues with leaving it disabled until Adrian adds support to Store v1.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.