PayPal Checkout plugin: 10 findings, two critical (VM 4.8.2 / Joomla 5.4.8)

[ptrouw]

While setting up paypal_checkout on VirtueMart 4.8.2 we ran into a payment failure and ended up documenting ten issues. Full report attached.

1. Order creation fails for every VAT order with quantity > 1, if With Breakdown is enabled. amount.breakdown.tax_total is computed from the unrounded per-unit tax and then rounded, while items[].tax is rounded per unit. PayPal validates tax_total as the sum of items[].tax × quantity, so the two differ by a cent and the order is rejected with UNPROCESSABLE_ENTITY. Depending on which check trips first you get TAX_TOTAL_MISMATCH or AMOUNT_MISMATCH. Workaround: set With Breakdown to No.

2. With Debug mode enabled, the OAuth bearer token is printed in the storefront checkout page, in full, together with the customer's shipping address. The token carries refund, payout and vault scopes and is valid for about nine hours.

The remaining eight are smaller: render() without a .catch(), two buttons rendered without checking the container exists, the stored client secret written into the admin form's value attribute, and the fact that PayPal's error response is replaced by one fixed message with nothing logged. That last one is why the first issue took us five test payments to find.

Measured on Joomla 5.4.8, VM 4.8.2, PHP 8.3, live credentials. Request and response bodies with debug_id values are in the attachment.