1) The gateway password is stored in plain text in tblpaymentgateways (seriously?).
2) With reference payments enabled, if a client updates their credit card information from the client area, the whole card number is stored. What SHOULD be happening is an auth for a tiny amount and the resulting transaction ID gets stored. WHMCS storing the whole credit card number for an updated card rather negates the point of a tokenized gateway, not that it really matters because...
3) Reference payments are not processing correctly at all despite being enabled in PayPal Manager and in the module itself. Verified in tblpaymentgateways that usereftrans is on.
Steps to reproduce:
a) Create new client account and initiate an order.
b) Pay with credit card and allow storage. This payment should work fine, and Client Profile -> Summary -> Credit Card Information should show something like this:
-------------------------------------------
Remote Gateway Token
xxxxxxxxxxxxxxx
* Only the last 4 digits of the credit card are stored locally since a token based remote storage module is being used
-------------------------------------------
c) Attempt to place another order using the stored card. The transaction will be declined and Billing -> Gateway Log will show something like this:
Invoice ID => nnnnn
User ID => nnnn
Amount => n.nn
RESULT => 23
PNREF => xxxxxxxxxx
RESPMSG => Invalid account number
Which is strange as no account number should be passed, it should be the transaction ID for the original charge which, if incorrect, would spit back RESULT => 19 and not 23.
4) If a client has a card on file, but chooses to use a different card at checkout but not store it for future use, the token stored in tblclients.gatewayid is updated anyway. I believe that if the client then attempted to use their on-file card, the wrong card would be charged as a reference to the non-stored card would be passed to the gateway. Of course I can't verify this because of (3) above.