[sldev] RE: Re: Re: Patch to Address Debit Permission Spoofing

[Jason Giglio]

Kele Kravelin wrote:
> Also keep in mind that with the changes to the quick pay button features 
> the need for vendors to have debit permissions has decreased since you 
> can force the user to only pay the correct amount (so unless you have 

No,  you can't.  That's just a client-side hint.  The agent can pay 
whatever they want.  If you trust SetPayPrice your object is very 
vulnerable.

-Jason