Skip to content

Commit 272b7b0

Browse files
judgejjudgej
committed
Issue thephpleague#19 Main changes.
1 parent 463cdc7 commit 272b7b0

9 files changed

+83
-80
lines changed

‎src/Message/AbstractRequest.php‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,16 @@
55
/**
66
* Authorize.Net Abstract Request
77
*/
8-
abstract class AbstractRequest extends \Omnipay\Common\Message\AbstractRequest
8+
9+
use Omnipay\Common\Message\AbstractRequest as CommonAbstractRequest;
10+
11+
abstract class AbstractRequest extends CommonAbstractRequest
912
{
13+
/**
14+
* Recommended custom field name to send the transaction ID to the notify handler.
15+
*/
16+
const TRANSACTION_ID_PARAM = 'omnipay_transaction_id';
17+
1018
public function getApiLoginId()
1119
{
1220
return $this->getParameter('apiLoginId');
@@ -99,7 +107,13 @@ protected function getBillingData()
99107
{
100108
$data = array();
101109
$data['x_amount'] = $this->getAmount();
110+
111+
// This is deprecated. The invoice number field is reserved for the invoice number.
102112
$data['x_invoice_num'] = $this->getTransactionId();
113+
114+
// A custom field can be used to pass over the merchant site transaction ID.
115+
$data[static::TRANSACTION_ID_PARAM] = $this->getTransactionId();
116+
103117
$data['x_description'] = $this->getDescription();
104118

105119
if ($card = $this->getCard()) {

‎src/Message/DPMCompleteRequest.php‎

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -9,62 +9,6 @@
99
*/
1010
class DPMCompleteRequest extends SIMCompleteAuthorizeRequest
1111
{
12-
public function getData()
13-
{
14-
// The hash sent in the callback from the Authorize.Net gateway.
15-
$hash_posted = strtolower($this->httpRequest->request->get('x_MD5_Hash'));
16-
17-
// The transaction reference generated by the Authorize.Net gateway and sent in the callback.
18-
$posted_transaction_reference = $this->httpRequest->request->get('x_trans_id');
19-
20-
// The amount that the callback has authorized.
21-
$posted_amount = $this->httpRequest->request->get('x_amount');
22-
23-
// Calculate the hash locally, using the shared "hash secret" and login ID.
24-
$hash_calculated = $this->getDpmHash($posted_transaction_reference, $posted_amount);
25-
26-
if ($hash_posted !== $hash_calculated) {
27-
// If the hash is incorrect, then we can't trust the source nor anything sent.
28-
// Throwing exceptions here is probably a bad idea. We are trying to get the data,
29-
// and if it is invalid, then we need to be able to log that data for analysis.
30-
// Except we can't, baceuse the exception means we can't get to the data.
31-
// For now, this is consistent with other OmniPay gateway drivers.
32-
33-
throw new InvalidRequestException('Incorrect hash');
34-
}
35-
36-
// The hashes have passed, but the amount should also be validated against the
37-
// amount in the stored and retrieved transaction. If the application has the
38-
// ability to retrieve the transaction (using the transaction_id sent as a custom
39-
// form field, or perhaps in an otherwise unused field such as x_invoice_id.
40-
41-
$amount = $this->getAmount();
42-
43-
if (isset($amount) && $amount != $posted_amount) {
44-
// The amounts don't match. Someone may have been playing with the
45-
// transaction references.
46-
47-
throw new InvalidRequestException('Incorrect amount');
48-
}
49-
50-
return $this->httpRequest->request->all();
51-
}
52-
53-
/**
54-
* This hash confirms the ransaction has come from the Authorize.Net gateway.
55-
* It confirms the sender knows ther shared hash secret and that the amount and
56-
* transaction reference has not been changed in transit.
57-
*/
58-
public function getDpmHash($transaction_reference, $amount)
59-
{
60-
$key = $this->getHashSecret()
61-
. $this->getApiLoginId()
62-
. $transaction_reference
63-
. $amount;
64-
65-
return md5($key);
66-
}
67-
6812
public function sendData($data)
6913
{
7014
return $this->response = new DPMCompleteResponse($this, $data);

‎src/Message/DPMCompleteResponse.php‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@
1616
*/
1717
class DPMCompleteResponse extends SIMCompleteAuthorizeResponse implements RedirectResponseInterface
1818
{
19-
const RESPONSE_CODE_APPROVED = '1';
20-
const RESPONSE_CODE_DECLINED = '2';
21-
const RESPONSE_CODE_ERROR = '3';
22-
const RESPONSE_CODE_REVIEW = '4';
23-
2419
public function isSuccessful()
2520
{
2621
return isset($this->data['x_response_code'])

‎src/Message/SIMAuthorizeRequest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ public function getData()
2828
$data['x_customer_ip'] = $this->getClientIp();
2929
}
3030

31-
// The returnUrl MUST be set in Authorize.net admin panel under
31+
// The returnUrl MUST be whitelisted in Authorize.net admin panel under
3232
// "Response/Receipt URLs".
3333
$data['x_relay_url'] = $this->getReturnUrl();
3434
$data['x_cancel_url'] = $this->getCancelUrl();

‎src/Message/SIMCompleteAuthorizeRequest.php‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,42 @@ class SIMCompleteAuthorizeRequest extends AbstractRequest
1111
{
1212
public function getData()
1313
{
14-
if (strtolower($this->httpRequest->request->get('x_MD5_Hash')) !== $this->getHash()) {
14+
// The hash sent in the callback from the Authorize.Net gateway.
15+
$hash_posted = strtolower($this->httpRequest->request->get('x_MD5_Hash'));
16+
17+
// The transaction reference generated by the Authorize.Net gateway and sent in the callback.
18+
$posted_transaction_reference = $this->httpRequest->request->get('x_trans_id');
19+
20+
// The amount that the callback has authorized.
21+
$posted_amount = $this->httpRequest->request->get('x_amount');
22+
23+
// Calculate the hash locally, using the shared "hash secret" and login ID.
24+
$hash_calculated = $this->getHash($posted_transaction_reference, $posted_amount);
25+
26+
if ($hash_posted !== $hash_calculated) {
27+
// If the hash is incorrect, then we can't trust the source nor anything sent.
28+
// Throwing exceptions here is probably a bad idea. We are trying to get the data,
29+
// and if it is invalid, then we need to be able to log that data for analysis.
30+
// Except we can't, baceuse the exception means we can't get to the data.
31+
// For now, this is consistent with other OmniPay gateway drivers.
32+
1533
throw new InvalidRequestException('Incorrect hash');
1634
}
1735

36+
// The hashes have passed, but the amount should also be validated against the
37+
// amount in the stored and retrieved transaction. If the application has the
38+
// ability to retrieve the transaction (using the transaction_id sent as a custom
39+
// form field, or perhaps in an otherwise unused field such as x_invoice_id.
40+
41+
$amount = $this->getAmount();
42+
43+
if (isset($amount) && $amount != $posted_amount) {
44+
// The amounts don't match. Someone may have been playing with the
45+
// transaction references.
46+
47+
throw new InvalidRequestException('Incorrect amount');
48+
}
49+
1850
return $this->httpRequest->request->all();
1951
}
2052

@@ -23,9 +55,16 @@ public function getData()
2355
* The transaction reference and the amount are both sent by the remote gateway (x_trans_id
2456
* and x_amount) and it is those that should be checked against.
2557
*/
26-
public function getHash()
58+
public function getHash($transaction_reference, $amount)
2759
{
28-
return md5($this->getHashSecret().$this->getApiLoginId().$this->getTransactionId().$this->getAmount());
60+
$key = array(
61+
$this->getHashSecret(),
62+
$this->getApiLoginId(),
63+
$transaction_reference,
64+
$amount,
65+
);
66+
67+
return md5(implode('', $key));
2968
}
3069

3170
public function sendData($data)

‎src/Message/SIMCompleteAuthorizeResponse.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,16 @@
99
*/
1010
class SIMCompleteAuthorizeResponse extends AbstractResponse
1111
{
12+
// Response codes returned by Authorize.Net
13+
14+
const RESPONSE_CODE_APPROVED = '1';
15+
const RESPONSE_CODE_DECLINED = '2';
16+
const RESPONSE_CODE_ERROR = '3';
17+
const RESPONSE_CODE_REVIEW = '4';
18+
1219
public function isSuccessful()
1320
{
14-
return isset($this->data['x_response_code']) && '1' === $this->data['x_response_code'];
21+
return isset($this->data['x_response_code']) && static::RESPONSE_CODE_APPROVED === $this->data['x_response_code'];
1522
}
1623

1724
public function getTransactionReference()

‎tests/Message/DPMCompleteRequestTest.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,14 @@ public function testGetDataInvalid()
2525
$this->request->getData();
2626
}
2727

28-
public function testGetDpmHash()
28+
public function testGetHash()
2929
{
30-
$this->assertSame(md5(''), $this->request->getHash());
30+
$this->assertSame(md5(''), $this->request->getHash('', ''));
3131

3232
$this->request->setHashSecret('hashsec');
3333
$this->request->setApiLoginId('apilogin');
3434

35-
$this->assertSame(md5('hashsec' . 'apilogin' . 'trnid' . '10.00'), $this->request->getDpmHash('trnid', '10.00'));
35+
$this->assertSame(md5('hashsec' . 'apilogin' . 'trnid' . '10.00'), $this->request->getHash('trnid', '10.00'));
3636
}
3737

3838
public function testSend()

‎tests/Message/SIMCompleteAuthorizeRequestTest.php‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,34 +23,36 @@ public function testGetDataInvalid()
2323

2424
public function testGetHash()
2525
{
26-
$this->assertSame(md5(''), $this->request->getHash());
26+
$this->assertSame(md5(''), $this->request->getHash('', ''));
2727

2828
$this->request->setHashSecret('hashsec');
2929
$this->request->setApiLoginId('apilogin');
30-
$this->request->setTransactionId('trnid');
31-
$this->request->setAmount('10.00');
3230

33-
$this->assertSame(md5('hashsecapilogintrnid10.00'), $this->request->getHash());
31+
$this->assertSame(md5('hashsec' . 'apilogin' . 'trnref ' . '10.00'), $this->request->getHash('trnref ', '10.00'));
3432
}
3533

3634
public function testSend()
3735
{
36+
$posted_trans_id = '12345'; // transactionReference in POST.
37+
$posted_amount = '10.00'; // amount authothorised in POST.
38+
3839
$this->getHttpRequest()->request->replace(
3940
array(
4041
'x_response_code' => '1',
41-
'x_trans_id' => '12345',
42-
'x_MD5_Hash' => md5('shhhuser9910.00'),
42+
'x_trans_id' => $posted_trans_id,
43+
'x_amount' => $posted_amount,
44+
'x_MD5_Hash' => md5('shhh' . 'user' . $posted_trans_id . $posted_amount),
4345
)
4446
);
4547
$this->request->setApiLoginId('user');
4648
$this->request->setHashSecret('shhh');
4749
$this->request->setAmount('10.00');
48-
$this->request->setTransactionId(99);
50+
//$this->request->setTransactionId(99);
4951

5052
$response = $this->request->send();
5153

5254
$this->assertTrue($response->isSuccessful());
53-
$this->assertSame('12345', $response->getTransactionReference());
55+
$this->assertSame($posted_trans_id, $response->getTransactionReference());
5456
$this->assertNull($response->getMessage());
5557
}
5658
}

‎tests/SIMGatewayTest.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ public function testCompleteAuthorize()
3939
array(
4040
'x_response_code' => '1',
4141
'x_trans_id' => '12345',
42-
'x_MD5_Hash' => md5('elpmaxeexample9910.00'),
42+
'x_amount' => '10.00',
43+
'x_MD5_Hash' => md5('elpmaxe' . 'example' . '12345' . '10.00'),
4344
)
4445
);
4546

@@ -68,7 +69,8 @@ public function testCompletePurchase()
6869
array(
6970
'x_response_code' => '1',
7071
'x_trans_id' => '12345',
71-
'x_MD5_Hash' => md5('elpmaxeexample9910.00'),
72+
'x_amount' => '10.00',
73+
'x_MD5_Hash' => md5('elpmaxe' . 'example' . '12345' . '10.00'),
7274
)
7375
);
7476

0 commit comments

Comments
 (0)