订购程序中的错误，可以绕过付款

Question

该项目使客户首先创建订单，他们必须通过Braintree支付所述订单。但我得到的问题是客户可以创建订单并关闭应用程序。这将导致订单仍然存在，但客户无需为其订单付款。如果有人知道解决这个问题，他们的帮助将会受到感谢。 （订单和付款工作。这只是我担心的这个错误）

订单控制器

    [HttpPost]
    [ValidateAntiForgeryToken]

    public async Task<ActionResult> FirstClassCreate(FormCollection values)
    {

        var order = new Order();
        TryUpdateModel(order);
        var customer = db.Users.FirstOrDefault(x => x.Email == User.Identity.Name);
        var cart = ShoppingCart.GetCart(this.HttpContext);



        try
        {

设置订单属性

            order.DeliveryDate = DateTime.Now.AddDays(1);

            order.DeliveryMethod = "First Class";
            order.FirstName = customer.FirstName;
            order.LastName = customer.LastName;
            order.PostalCode = customer.PostalCode;
            order.State = customer.State;
            order.City = customer.City;
            order.Email = customer.Email;
            order.Country = customer.Country;
            order.Phone = customer.PhoneNumber;
            order.Address = customer.Address;

            order.Username = customer.Email;
            order.OrderDate = DateTime.Now;
            var currentUserId = User.Identity.GetUserId();
            order.Total = cart.GetFirstClass();

            if (order.SaveInfo && !order.Username.Equals("guest@guest.com"))
            {

                var manager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()));
                var store = new UserStore<ApplicationUser>(new ApplicationDbContext());
                var ctx = store.Context;
                var currentUser = manager.FindById(User.Identity.GetUserId());



                //Save this back
                //http://stackoverflow.com/questions/20444022/updating-user-data-asp-net-identity
                //var result = await UserManager.UpdateAsync(currentUser);
                await ctx.SaveChangesAsync();

                await storeDB.SaveChangesAsync();
            }

将订单保存到数据库

            //Save Order
            storeDB.Orders.Add(order);
            await storeDB.SaveChangesAsync();
            //Process the order
            cart = ShoppingCart.GetCart(this.HttpContext);
            order.Total = cart.GetFirstClass();

            order = cart.CreateOrder(order);


            return RedirectToAction("FirstClass", "Checkouts");



        }
        catch
        {
            //Invalid - redisplay with errors
            return View(order);
        }
    }

结帐控制器

    public ActionResult CreateFirstClass(FormCollection collection)
    {
        var gateway = config.GetGateway();
        Decimal amount;

        //Need to get the amount

        try
        {
            amount = Convert.ToDecimal(Request["amount"]);
        }
        catch (FormatException e)
        {
            TempData["Flash"] = "Error: 81503: Amount is an invalid format.";
            return RedirectToAction("New");
        }

        string nonceFromTheClient = collection["payment_method_nonce"];

        var cart = ShoppingCart.GetCart(this.HttpContext);

        //if (id == null)
        //{
        //    return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
        //}
        //order =  Orders.FindAsync(id);

获取必要的付款方式

        var request = new TransactionRequest
        {
            Amount = cart.GetFirstClass(),
            PaymentMethodNonce = nonceFromTheClient,
            Options = new TransactionOptionsRequest
            {
                SubmitForSettlement = true
            }
        };
        cart.EmptyCart();

        Result<Transaction> result = gateway.Transaction.Sale(request);



        if (result.IsSuccess())
        {
            Transaction transaction = result.Target;
            return RedirectToAction("Show", new { id = transaction.Id });
        }
        else if (result.Transaction != null)
        {
            return RedirectToAction("Show", new { id = result.Transaction.Id });
        }
        else
        {
            string errorMessages = "";
            foreach (ValidationError error in result.Errors.DeepAll())
            {
                errorMessages += "Error: " + (int)error.Code + " - " + error.Message + "\n";
            }
            TempData["Flash"] = errorMessages;
            return RedirectToAction("New");
        }

    }

＃