Authorize.net submission happens even if form has failed validation

Scenario: We have an order form where a user selects a product, then chooses a shipping method, enters their address and credit card details. If the user has chosen a product and entered their card details, but neglected to enter a shipping method, then the form will fail validation and return the user to the form to select the correct shipping method and resubmit.

The problem is that the authorizenetwebform_process() still make the call to Authorize.net and because all the authorize.net fields are correctly filled out, charges the card. So when the customer resubmits their order, the charge goes through twice.

Filing this as Critical as it can result in customers losing money, which is pretty serious business for an eCommerce module.

Fix is to check to see if there are any errors buffered for the form at the top of authorizenetwebform_process() and bail out if there are. As anwf_process is called as part of the "additional processing" then we have access to any errors that the native FormAPI components have thrown.

Fix:

function authorizenetwebform_process($step, $node, $form, $form_state) {
  module_load_include('inc', 'authorizenetwebform', '/authorizenetwebform_fields');
  $form_values = $form_state['values'];

+  // DO NOT forward to Authorize.net if there are errors in the form validation
+  if(form_get_errors()) {
+   return $form_state;
+  }
...