Late payment of a cancelled order leads to success page

[EinShoppo]

Q	A
Bug report?	yes
Feature request?	no
BC Break report?	no
RFC?	no

Hi @dpfaffenbauer,

I have discovered a bug that affects canceled orders.

Steps to reproduce:

• When a customer proceeds to checkout
• The customer remains on the page of an external payment provider, e.g. paypal.com.
• The order is canceled (via expiration command or manually).
• And the customer makes a payment

Current behavior:

• The status of the order is still canceled
• The payment status is set to 'paid'
• The customer is redirected to the 'thank you' page.

Expected behavior:

• The status of the order is still 'canceled' (I think this is reasonable, because a cancellation should never be able to be canceled by the customer)
• The payment status is set to 'paid' (I think this is also fine, as we are probably not able to prevent the payment process and the status should always show the current status)
• I'm not sure what to do here: maybe the customer should be redirected to an error page with a message like "Sorry, we received your payment, but we had some issues with your order. Please contact our customer service. Etc."

What do you think about this? I think it's very unfortunate if the customer is redirected to the success page but the order has already been canceled and will never be processed. It is certainly an edge case, but when it occurs, it leads to a real problem.

https://github.com/coreshop/CoreShop/blob/0dbc97328586f3bfc41ba02831df1ae5c49c6792/src/CoreShop/Bundle/FrontendBundle/Controller/CheckoutController.php#L232C1-L247C10

Best regards