CiviCRM Community Forums (archive)

Version: CiviCRM 4.2.8/Drupal 6

Symptom: the emailed receipts for recurring contributions contains links to update contribution amounts and billing details. When followed, those links load information for the wrong recurring subscription. In fact, they always load the information for the chronologically first subscription in the db (a hint to the cause).

Location of the problem: in CRM/Contribution/BAO/ContributionRecur.php, the function getSubscriptionDetails(), which attempts to match subscriptions against a contribution ID, is finding multiple matches, one for every subscription in the civicrm_contribution_recur table. It returns the first one, instead of the correct one.

The fix:

Lines 393--399 currently are:

    elseif ($entity == 'contribution') {
      $sql .= "
      FROM civicrm_contribution       con
INNER JOIN civicrm_contribution_recur rec
LEFT  JOIN civicrm_membership_payment mp  ON ( mp.contribution_id = con.id )
     WHERE con.id = %1";
    }

Should be (note addition to INNER JOIN):

    elseif ($entity == 'contribution') {
      $sql .= "
      FROM civicrm_contribution       con
INNER JOIN civicrm_contribution_recur rec ON ( rec.id = con.contribution_recur_id )
LEFT  JOIN civicrm_membership_payment mp  ON ( mp.contribution_id = con.id )
     WHERE con.id = %1";
    }

I have verified on our own installation that this change fixes the problem.

Seems like a pretty serious issue, since the bug effectively allows one person to alter the billing details of another user's subscription. This may also be the cause of some others' reported experiences in being unable to update recurring subscriptions.

Robert

Issue added with diff:
http://issues.civicrm.org/jira/browse/CRM-12256