Hello everyone,
I post this issue on this forum before but I got the same issue again and I realized some new things. (Old post: https://community.playfab.com/questions/54964/playfab-accepting-pending-payments.html).
First of all, this issue happened to me again with the IDR currency (Indonesia). I'm not sure what the client did to get stuck on the charging step.
While confirming receipts, I log the receipts in Cloudscript. This is one of the pending purchases that passed PlayFab check, but not being charged.
As it can be seen from the image, the purchase state of the receipt is 4, however, the receipt's valid value is true. I guess, PlayFab only checks the valid value. So, this receipt passes the PlayFab check. I searched the purchase state 4 on the Internet, but couldn't find any information about it. When a client is charged successfully and send receipt to PlayFab, the purchase state is always 1, which means "Charged". (The receipts with purchase state 4 becomes "canceled" 3 days after the purchase date).
I'm using Unity IAP to handle purchases. A temporary solution can be checking the purchase state of the receipts. If the state is 4, don't execute the validate API. However, a hacked client can still bypass the if statement and can send pending receipts to PlayFab to buy items in the game without being charged. PlayFab should also check the purchase state in my opinion.
