Service activated without invoice paiement

[Blesta Addons]

Yesterday, we have found a 2 service was activated without a success paiement, from blesta , the invoice (Proforma) is still open and not paid, the services was activated . from logs we have the fallowing

Provision Paid Pending Services : Attempting to provision paid pending services. The pending service #14863 from client #11977 is now active. The pending service #14864 from client #11977 is now active. The paid pending services task has completed.

Accept Paid Pending Orders : Attempting plugin cron for order accept_paid_orders. Finished plugin cron for order accept_paid_orders.

Deliver Invoices : Attempting to deliver invoices scheduled for delivery. Successfully delivered 1 invoice to client #3776 via Email. The deliver invoices task has completed.

we have blesta 4.1.2 .

How can this occur ?

[Blesta Addons]

u have check the next cron log to see if a paid invoice sent , and there are no paid invoice sent .!!!

i have also check the cron before this one to see if there are any accepted order or paiement apply to a invoice, and nothing.

so this service was added even if the invoice was not paid, also i check the transaction logs and nothing, from the gateway log, it was paiement from the cleint in the same time but it has a error return !!!

[Blesta Addons]

Owwww, this is not related to one service, all pending service are activated auto by cron? how can this happen, we have not touched or changed any files from so long time !!!!

IS URGENT and trivial .

 

[Paul]

You opened a ticket and we have been communicating there. It appears not to affect all of your services, just ones that are provisioned after a pending service is created, but before it's corresponding invoice is created. So that the provision paid pending automation tasks doesn't think there is an invoice for the service. You had a 3 second delay between service creation, and invoice creation, and the automation task running in the middle of that.

When looking at some of our own order data from live and test systems, services and invoices are created during the same second, almost at exactly the same time. Since you have a fairly significant delay between service and invoice generation, this is more likely to happen.

I have created a task so that we can investigate further and determine the best solution. In the meantime, I would suggest either decreasing how often your provision task runs, or investigate why there is such a big delay between service and invoice creation. Slow systems? Events that are being triggered and taking time to run? I'm not sure why there is such a delay between these actions, but I'm not able to replicate it in our environments.

[Blesta Addons]

yes, we have spoken in the ticket, but if the cron are running and the system try to create service & then invoice is normal to have a delay(1 or 5 second) as the cron are running and making a queries to database, and the database with a huge amount of data. 

i can confirm that there are no event for services trigger.

[Blesta Addons]

i have made some benchmark in the same system, and i have found that the service/invoice created in the same second (Service Added 2018-01-11 16:45:25, Invoice Added 2018-01-11 16:45:25).

but as i told before, when the cron is running, the thing is changed as the system need to handle some request in the same time and that load to a second or 5, if the cron activating a service in a remote server like cpanel or plesk i'm 100% sur will not take 1 second .

so this case has probability to occur 1% . a cron is running when a client confirm the order form, it will not occur all the time, but this probability exist and in our chance this happens yesterday for 2 times, so it should be in consideration like such case.

is difficult to reproduce this manually. incrementing the cron to run every 10 or 15 min is not a solution for us, we need to serve the clients as soon as possible, already we considerate 5 min is a big time .

with a smarty hacker with some boots tools can do the order and get service without making any payment .

 

[activa]

It seem like a exploit hhhhh. Anyway this should have a fix. A 1 to 5 seconds is a big time for some kids....

[Tyson]

This issue is a race condition between the creation of a service invoice and the cron running paid pending services. This is assigned CORE-2581 and a work-around is described in that task.