Entering "'20.0%'" as payment method fee causes server error

[mkllnk]

Description

Updating a payment method can cause a server error when entering invalid values.

It looks like someone tried to give a 20% discount by entering that value.

Expected Behavior

Invalid values should not be allowed or there should be a proper error message.

Actual Behaviour

It shows the snail.

Steps to Reproduce

1. Edit a cash payment method.
2. Select the "per item" calculator.
3. Enter '20.0' with the single quotes as fee amount.
4. Save.

Animated Gif/Screenshot

Workaround

Severity

bug-s1: a critical feature is broken: checkout, payments, signup, login
bug-s2: a non-critical feature is broken, no workaround
bug-s3: a feature is broken but there is a workaround
bug-s4: it's annoying, but you can use it
bug-s5: we can live with it, only a few users impacted

https://github.com/openfoodfoundation/openfoodnetwork/wiki/Bug-severity

Your Environment

• Version used:
• Browser name and version:
• Operating System and version (desktop or mobile):

Possible Fix

The only figures that should be allowed are:

• numbers 0123456789
• decimal point .
• negative sign -

The error message should read:
Invalid input. Please use only numbers. For example: 10, 5.5, -20

Error in OpenFoodNetwork

ArgumentError in spree/admin/payment_methods#update
invalid value for BigDecimal(): "'-20'"

View on Bugsnag

Stacktrace

app/models/spree/preferences/preferable.rb:119 - BigDecimal
app/models/spree/preferences/preferable.rb:119 - convert_preference_value
app/models/spree/preferences/preferable_class_methods.rb:26 - block in preference
lib/spree/localized_number.rb:29 - call
lib/spree/localized_number.rb:29 - block (2 levels) in localize_number
app/controllers/spree/admin/payment_methods_controller.rb:43 - update

View full stacktrace

Created by Maikel via Bugsnag

[RachL]

@mkllnk does this one occur for all negative figures? If so it can be a bigger problem than an s4 :(

[mkllnk]

No, the problem is the asterisk * at the front. The person thought that they can multiply like this. Just -20 should work.

[mkllnk]

No, actually, there is not asterisk. The mistake was to add single quotes: '-20'.

[meronogbai]

Can I pick this up?

[apricot12]

Can I pick this up?

I just assigned you this issue. You can pick it up 😄

[filipefurtad0]

To close this issue, other payment methods (other then Check) should be considered:

• Check -> addressed in 6942 fix payment method fee bug #8144
• StripeSCA
• Paypal

Also, all calculator types should be considered:

• Flat percent
• Flat Rate (per order) -> addressed in 6942 fix payment method fee bug #8144
• Flexible Rate
• Flate Rate (per Item) -> addressed in 6942 fix payment method fee bug #8144
• Price Sack

Combinations of the above should be considered when testing.