Epay plugin

We use ePay plugin in our shop and we have just discovered a possible error.

In the setupwe have set that customers can not change the payment or pay later. But when there is created an order and you come to ePay payment, they can cancel here. Then the order shown in the order overview as if it is paid. Double checking we do not ePay, we will not discover that has not been paid.
Is it something you have knowledge of and possibly a solution?

Thanks to enable the md5, and thanks for the report.

I add the edition of this plugin for more security on our TODO list.

Xavier wrote: Thanks to enable the md5

Yes to improve the security.

This plugin has not been developed by our team, and some security check are missing.

Thx

Are you then in a dialog with epay.dk about to optimize the plugin?

Thank you
I have also contacted ePay when we receive about 20 mails every time there is a paid order, they say it is an error in our hika setup, but I'm still waiting for an answer to where.
Is it something you know?
In addition, I wish that we can set up goals in analytics, to create goals for trade. It can happen at the confirmation page, but I can not figure out what it's called

Just as you describe it sending 20 mails to admin about the confirmation of the payment.

I mean in analytics it possible to set up goals, and here I think about to use the site the costumer is landing on after the payment have been confirmed. I mean there is standing something like : thanks for you order.

I have made the chage and it seems to work, now we only recived one mail.

But its an error

Hello,
An ePay notification was refused because the notification from the ePay server was invalid

Is it because I have used the test number from Epay?
In the shop backend the order is has been marked as cancelled

ok thx i have not set MD5, but thats done now..

Hello
We experienced yesterday a little bug, I call it the ePay plugin. Perhaps it is not.
We have a customer who ordered a product and came to the payment part. Here he noted that we did not accept his card and canceled / closed the payment window.
We did receive an email that there was created an order on the page, and after a long search we also found out that it was as created and not confirmed as when it is paid.
Now the question is whether or not it is wrong to order is created without the receipt of payment for the goods? We contacted However, subsequent client and it's all done, we got a new customer
But could there be a possibility that in some way are told that the purchase was canceled by the customer?

Thanks for the reply.
When this happens, the order is just to set up and we have the information on the customer. So the problem is not larger.
Here we use the shop to mainly our dealers, but also to individuals and companies. Therefore, we obtain yet all information into an accounting program.
But it was just a matter of opportunity, the most important is the information we receive.