Possible misconfiguration; possible fraud

[HarryAdney]

Hi everyone,

I have a signup for shared hosting. On the manage orders page, where I can manually accept, cancel, cancel and refund, etc., the following information shows:

Item	Description	Billing Cycle	Amount	Status	Payment Status
Shared Hosting	Hosting Packages - Unlimited Package datasupplies.harryadney.com (www whois intoDNS)	Monthly	£19.99	Pending	Incomplete

 

The domain appears to be a subdomain of my domain (harryadney.com). Is this normal until the order is accepted?

[brian!]

at a guess, I would think that when ordering, they've just selected the "use existing domain" option and entered datasupplies.harryadney in there...

a little naughty of them if you aren't offering subdomains with the product... if true, i'd put this more in the category of fraud than misconfiguration... but do a dummy test order, similar to above (datasupplies2.harryadney), and see if it looks the same on the Manage Orders page.

[HarryAdney]

Awesome brian!, Thanks for getting back to me on this so quickly.

Is there a setting I can use to stop people doing this?

[brian!]

1 hour ago, HarryAdney said:

Is there a setting I can use to stop people doing this?

sadly not - there are few checks with the cart in general, and fewer with the existing domain option... you'll be looking at editing the template or using a hook.

if thinking of editing the template, you could use HTML5 patterns as per the thread below...

if you would prefer to use a hook, there would be a number of ways - ShoppingCartValidateDomain would be one way, using jQuery would be another - in fact, @stormy recently posted code that i've quickly rewritten for your purpose as a hook (attached)..

it will do a number of things - firstly, if someone tries to add 'harryadney' to the sld input (left input field), then it removes that string... so in your case, if they had entered 'datasupplies.harryadney', the hook would change that too 'datasupplies' - the order will still go though because we're not checking whether datasupplies.com exists or not, but they shouldn't be able to use your domain (or any others that you add) from now on.

additionally, if somebody tries to play silly buggers and adds 'harryadney.com' to the tld input (right input field), it will get removed... e.g if they had entered 'datasupplies' in the sld field and 'harryadney.com' in the tld field, the order will still likely have gone through (that might be another way of how they did it)... with this hook, it won't progress any further because the tld field will be empty and they will have to enter another TLD.

owndomain.php

[HarryAdney]

Thanks mate. Do I just upload owndomain.php to the hooks folder? I'm not familiar with hooks, tbh.

[brian!]

9 minutes ago, HarryAdney said:

Thanks mate. Do I just upload owndomain.php to the hooks folder? I'm not familiar with hooks, tbh.

yeah, just plonk it in /includes/hooks and you should be good to go.

[HarryAdney]

Many thanks; all done.