View Issue Details

IDProjectCategoryView StatusLast Update
0007422module PayPal Checkoutmodule PayPal checkout - subpublic2023-05-10 15:06
Status resolvedResolutionfixed 
Product Version2.2.2 / 1.2.2 
Target VersionFixed in Version2.3.0 / 1.3.0 
Summary0007422: Same state/county IDs may lead to wrong display on PayPal page
DescriptionThe PayPal Checkout module does not check correctly for fitting state. It uses only the state ID from the address data, which may result in a different return than expected. The oxstates table uses OXID and OXCOUNTRYID as the primary key. The OXID is same as the actual state ID. When adding additional states, like the british counties, there may be doubled OXIDs. This is no problem for the database and the shop itself also seems to handle it correctly, but the PayPal module just checks for OXID and not for OXCOUNTRYID. This can lead to the case that a wrong state is displayed on the PayPal page.

Steps To Reproduce- Add at least two entries with same OXID to your oxstates table. Assuming a standard installation, you should have Canadian province Saskatchewan (SK) already in your database. Then also add british county Suffolk (OXID = SK, OXCOUNTRYID = a7c40f632a0804ab5.18804076, OXTITLE = Suffolk, OXISOALPHA2 = SK).
- Create a user with address including state Suffolk.
- Do an order using PayPal with this user.
- While on PayPal page, you see Saskatchewan instead of Suffolk as an address.

If this does not work, try different way around: User from Saskatchewan and then you probably see Suffolk on PayPal page. Usually first one from database is used.
Additional InformationIt happens in several places in the module's code, but one example is in OxidSolutionCatalysts\PayPal\Core\OrderRequestFactory::getShippingAddress:

$state = oxNew(State::class);

Assuming aboves example, the result for loading a State model with OXID "SK" may return different data sets.
TagsNo tags attached.


child of 0007425 acknowledgedvilma_liorensaityte OXID eShop (all versions) unique oxstates.oxid is not enforced 


There are no notes attached to this issue.