Index: branches/5.3.x/units/orders/orders_event_handler.php
===================================================================
diff -u -N -r16398 -r16506
--- branches/5.3.x/units/orders/orders_event_handler.php	(.../orders_event_handler.php)	(revision 16398)
+++ branches/5.3.x/units/orders/orders_event_handler.php	(.../orders_event_handler.php)	(revision 16506)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: orders_event_handler.php 16398 2016-11-12 18:54:52Z alex $
+* @version	$Id: orders_event_handler.php 16506 2016-12-26 18:27:04Z alex $
 * @package	In-Commerce
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license	Commercial License
@@ -65,11 +65,6 @@
 						// user can't edit orders being processed
 						return false;
 					}
-
-					if ( $event->Name == 'OnUpdate' ) {
-						// all checks were ok -> it's user's order -> allow to modify
-						return true;
-					}
 				}
 			}
 		}
@@ -128,7 +123,9 @@
 			'OnSelectAddress'		=>	Array('self' => true),
 			'OnProceedToBilling'	=>	Array('self' => true),
 			'OnProceedToPreview'	=>	Array('self' => true),
+			'OnProceedToPreviewAjax' => array('self' => true),
 			'OnCompleteOrder'		=>	Array('self' => true),
+			'OnUpdate' => array('self' => true),
 			'OnUpdateAjax'			=>	Array('self' => true),
 
 			'OnRemoveCoupon'		=>	Array('self' => true),
@@ -524,8 +521,15 @@
 				WHERE '. $config->getIDField() .' = '.$order_id;
 		$this->Conn->Query($sql);
 
+		// Remember order ID for use on "Thank You" page.
 		$this->Application->StoreVar('front_order_id', $order_id);
+
+		// Remove globals, set from "_createNewCart" method.
+		$this->Application->DeleteVar('ord_id');
 		$this->Application->RemoveVar('ord_id');
+
+		// Prevent accidental access to non-Incomplete order.
+		$this->Application->removeObject($event->getPrefixSpecial());
 		$this->Application->Session->SetCookie('shop_cart_cookie', '', strtotime('-1 month'));
 	}
 
@@ -2541,7 +2545,10 @@
 			$order_helper = $this->Application->recallObject('OrderHelper');
 			/* @var $order_helper OrderHelper */
 
-			$object->SetDBField('PaymentCardType', $order_helper->getCreditCartType($object->GetDBField('PaymentAccount')));
+			$object->SetDBField(
+				'PaymentCardType',
+				$order_helper->getCreditCardType($object->GetDBField('PaymentAccount'))
+			);
 		}
 		else {
 			$object->SetDBField('PaymentCardType', '');
@@ -4103,13 +4110,29 @@
 	/**
 	 * Performs order update and returns results in format, needed by FormManager
 	 *
-	 * @param kEvent $event
+	 * @param kEvent $event Event.
+	 *
+	 * @return void
 	 */
-	function OnUpdateAjax($event)
+	protected function OnUpdateAjax(kEvent $event)
 	{
+		/** @var AjaxFormHelper $ajax_form_helper */
 		$ajax_form_helper = $this->Application->recallObject('AjaxFormHelper');
-		/* @var $ajax_form_helper AjaxFormHelper */
-
 		$ajax_form_helper->transitEvent($event, 'OnUpdate');
 	}
+
+	/**
+	 * Performs order update after billing step submission and returns results in format, needed by FormManager
+	 *
+	 * @param kEvent $event Event.
+	 *
+	 * @return void
+	 */
+	protected function OnProceedToPreviewAjax(kEvent $event)
+	{
+		/** @var AjaxFormHelper $ajax_form_helper */
+		$ajax_form_helper = $this->Application->recallObject('AjaxFormHelper');
+		$ajax_form_helper->transitEvent($event, 'OnProceedToPreview');
+	}
+
 }