Differential D23639 Diff 66771 community/donations/notify.php

Changeset View

Standalone View

View Options

community/donations/notify.php

1<?php 1​<?php
2 2​
3$do_debug = true; 3​$do_debug = true;
4​$debug = "";
4 5​
5// STEP 1: read POST data 6​// STEP 1: read POST data
6 7​
7// Reading POSTed data directly from $_POST causes serialization issues with array data in the POST. 8​// Reading POSTed data directly from $_POST causes serialization issues with array data in the POST.
8// Instead, read raw POST data from the input stream. 9​// Instead, read raw POST data from the input stream.
9$raw_post_data = file_get_contents('php://input'); 10​$raw_post_data = file_get_contents('php://input');
10$raw_post_array = explode('&', $raw_post_data); 11​$raw_post_array = explode('&', $raw_post_data);
11$myPost = array(); 12​$myPost = array();
12foreach ($raw_post_array as $keyval) { 13​foreach ($raw_post_array as $keyval) {
13 $keyval = explode ('=', $keyval); 14​ $keyval = explode ('=', $keyval);
14 if (count($keyval) == 2) 15​ if (count($keyval) === 2)
15 $myPost[$keyval[0]] = urldecode($keyval[1]); 16​ $myPost[$keyval[0]] = urldecode($keyval[1]);
16} 17​}
17 18​
18// read the IPN message sent from PayPal and prepend 'cmd=_notify-validate' 19​// read the IPN message sent from PayPal and prepend 'cmd=_notify-validate'
19$req = 'cmd=_notify-validate'; 20​$req = 'cmd=_notify-validate';
20if(function_exists('get_magic_quotes_gpc')) { 21​if(function_exists('get_magic_quotes_gpc')) {
21 $get_magic_quotes_exists = true; 22​ $get_magic_quotes_exists = true;
22} 23​}
23foreach ($myPost as $key => $value) { 24​foreach ($myPost as $key => $value) {
24 if($get_magic_quotes_exists == true && get_magic_quotes_gpc() == 1) { 25​ if($get_magic_quotes_exists === true && get_magic_quotes_gpc() === 1) {
25 $value = urlencode(stripslashes($value)); 26​ $value = urlencode(stripslashes($value));
26 } else { 27​ } else {
27 $value = urlencode($value); 28​ $value = urlencode($value);
28 } 29​ }
29 $req .= "&$key=$value"; 30​ $req .= "&$key=$value";
30} 31​}
31 32​
32if ($do_debug) { 33​if ($do_debug) {
33 $debug = fopen('/tmp/data.txt', 'a+'); 34​ $debug = fopen('/tmp/data.txt', 'a+');
aacidUnsubmitted
Done

do we need this?

aacid: do we need this?
34 fwrite($debug, "Raw Data: $raw_post_data\n"); 35​ fwrite($debug, "Raw Data: $raw_post_data\n");
35 fwrite($debug, "PHP Decoded: " . var_export($_POST, true) . "\n"); 36​ fwrite($debug, "PHP Decoded: " . var_export($_POST, true) . "\n");
36 fwrite($debug, "verify: $req\n"); 37​ fwrite($debug, "verify: $req\n");
37} 38​}
38 39​
39 40​
40$ch = curl_init('https://www.paypal.com/cgi-bin/webscr'); 41​$ch = curl_init('https://www.paypal.com/cgi-bin/webscr');
41curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1); 42​curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
aacidUnsubmitted
Done

and here

aacid: and here
42curl_setopt($ch, CURLOPT_POST, 1); 43​curl_setopt($ch, CURLOPT_POST, 1);
43curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); 44​curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
44curl_setopt($ch, CURLOPT_POSTFIELDS, $req); 45​curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
45curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1); 46​curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
46curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); 47​curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
47curl_setopt($ch, CURLOPT_FORBID_REUSE, 1); 48​curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);
48curl_setopt($ch, CURLOPT_HTTPHEADER, array('Connection: Close')); 49​curl_setopt($ch, CURLOPT_HTTPHEADER, array('Connection: Close'));
49 50​
50// In wamp-like environments that do not come bundled with root authority certificates, 51​// In wamp-like environments that do not come bundled with root authority certificates,
51// please download 'cacert.pem' from "http://curl.haxx.se/docs/caextract.html" and set 52​// please download 'cacert.pem' from "http://curl.haxx.se/docs/caextract.html" and set
52// the directory path of the certificate as shown below: 53​// the directory path of the certificate as shown below:
53// curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '/cacert.pem'); 54​// curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '/cacert.pem');
54if( !($res = curl_exec($ch)) ) { 55​if( !($res = curl_exec($ch)) ) {
55 if ($do_debug) { 56​ if ($do_debug) {
56 fwrite($debug, "Error in calling curl_exec\n"); 57​ fwrite($debug, "Error in calling curl_exec\n");
57 } 58​ }
aacidUnsubmitted
Done

i think we're always running in debug (double check with ben, so no need to have these error_log calls?)

aacid: i think we're always running in debug (double check with ben, so no need to have these…
58 curl_close($ch); 59​ curl_close($ch);
59 exit; 60​ exit;
60} 61​}
61curl_close($ch); 62​curl_close($ch);
62 63​
63if (strcmp ($res, "VERIFIED") == 0) { 64​if (strcmp ($res, "VERIFIED") === 0) {
64 // assign posted variables to local variables 65​ // assign posted variables to local variables
aacidUnsubmitted
Done

this doesn't seem like an error

aacid: this doesn't seem like an error
65 $item_name = $_POST['item_name']; 66​ $item_name = $_POST['item_name'];
66 $item_number = $_POST['item_number']; 67​ $item_number = $_POST['item_number'];
67 $payment_status = $_POST['payment_status']; 68​ $payment_status = $_POST['payment_status'];
68 $payment_amount = $_POST['mc_gross']; 69​ $payment_amount = $_POST['mc_gross'];
69 $payment_currency = $_POST['mc_currency']; 70​ $payment_currency = $_POST['mc_currency'];
70 $txn_id = $_POST['txn_id']; 71​ $txn_id = $_POST['txn_id'];
71 $memo = $_POST['memo']; 72​ $memo = $_POST['memo'];
72 $receiver_email = $_POST['receiver_email']; 73​ $receiver_email = $_POST['receiver_email'];
73 $payer_email = $_POST['payer_email']; 74​ $payer_email = $_POST['payer_email'];
74 $donate_url = $_POST['custom']; 75​ $donate_url = $_POST['custom'];
75 76​
76 require("donations_auth.inc"); 77​ require("config.php");
77 ​
78 /* ​
79 $query = "CREATE TABLE IF NOT EXISTS donations ( id "; ​
80 $query .= "INT AUTO_INCREMENT PRIMARY KEY, date DATETIME, "; ​
81 $query .= "amount float(10,2), message VARCHAR(255), "; ​
82 $query .= "transactionid VARCHAR(255) UNIQUE, donate_url VARCHAR(255) )"; ​
83 mysql_query($query,$sq); ​
84 echo mysql_error(); ​
85 */ ​
86 78​
87 // check the payment_status is Completed 79​ // check the payment_status is Completed
88 if ( $payment_status != "Completed") { 80​ if ( $payment_status !== "Completed") {
89 if ($do_debug) { 81​ if ($do_debug) {
90 fwrite($debug, "Unexpected payment status: ".$payment_status."\n"); 82​ fwrite($debug, "Unexpected payment status: ".$payment_status."\n");
91 } 83​ }
92 die("Payment status is ".$payment_status); 84​ die("Payment status is ".$payment_status);
93 } 85​ }
94 86​
95 // check that receiver_email is your Primary PayPal email 87​ // check that receiver_email is your Primary PayPal email
96 if ( $receiver_email != "kde-ev-board@kde.org") { 88​ if ( $receiver_email !== "kde-ev-board@kde.org") {
aacidUnsubmitted
Done

I would rather you don't change this since the current setup works, why are you changing it?

aacid: I would rather you don't change this since the current setup works, why are you changing it?
97 if ($do_debug) { 89​ if ($do_debug) {
98 fwrite($debug, "Unexpected receiver email: ".$receiver_email."\n"); 90​ fwrite($debug, "Unexpected receiver email: ".$receiver_email."\n");
99 } 91​ }
100 die("Unknown email"); 92​ die("Unknown email");
101 } 93​ }
102 94​
103 // check that payment_amount/payment_currency are correct 95​ // check that payment_amount/payment_currency are correct
104 if ( $payment_currency != "EUR" ) { 96​ if ( $payment_currency !== "EUR" ) {
105 if ($do_debug) { 97​ if ($do_debug) {
106 fwrite($debug, "Unexpected payment currency: ".$payment_currency."\n"); 98​ fwrite($debug, "Unexpected payment currency: ".$payment_currency."\n");
107 } 99​ }
108 die("Unknown currency used"); 100​ die("Unknown currency used");
109 } 101​ }
110 102​
111 // sanitise date 103​ // sanitise date
112 $date = strtotime( $_POST["payment_date"] ); 104​ $date = strtotime( $_POST["payment_date"] );
113 if ( $date === false ) { 105​ if (!$date) {
114 echo "Date parsing failed, assuming now()"; 106​ echo "Date parsing failed, assuming now()";
115 $date = time(); 107​ $date = time();
116 } 108​ }
117 $date = date("Y-m-d H:i:s", $date); 109​ $date = date("Y-m-d H:i:s", $date);
118 110​
119 // process payment 111​ // process payment
120 $query = "REPLACE into donations VALUES( '', \"".$date."\""; 112​ $stmt = $dbConnection->prepare("REPLACE into donations VALUES( NULL, :date, :payment_amount, :memo, :txn_id, :donate_url)");
121 $query .= ", ".$payment_amount.", \"".addslashes( $memo )."\""; 113​ $stmt->execute([
122 $query .= ",\"".$txn_id."\", \"".addslashes( $donate_url )."\" )"; 114​ 'date' => $date,
123 mysql_query($query, $sq); 115​ 'payment_amount' => $payment_amount,
116​ 'memo' => addslashes($memo),
117​ 'txn_id' => $txn_id,
118​ 'donate_url' => addslashes($donate_url),
119​ ]);
124 120​
125 if ($do_debug) { 121​ if ($do_debug) {
126 fwrite( $debug, "\nQuery:".$query."\n" ); 122​ fwrite( $debug, "\nQuery:".$stmt->debugDumpParams()."\n" );
127 fwrite( $debug, "Error:".mysql_error()."\n" ); ​
128 } 123​ }
129 124​
130 125​
131} else if (strcmp ($res, "INVALID") == 0) { 126​} else if (strcmp ($res, "INVALID") === 0) {
132 if ($do_debug) { 127​ if ($do_debug) {
133 fwrite($debug, "Invalid transaction\n"); 128​ fwrite($debug, "Invalid transaction\n");
134 } 129​ }
135} else { 130​} else {
136 if ($do_debug) { 131​ if ($do_debug) {
137 fwrite($debug, "Paypal returned neither VERIFIED nor INVALID\n"); 132​ fwrite($debug, "Paypal returned neither VERIFIED nor INVALID\n");
138 fwrite($debug, $res."\n"); 133​ fwrite($debug, $res."\n");
139 } 134​ }
140} 135​}
141 136​
142if ($do_debug) { 137​if ($do_debug) {
143 fwrite( $debug, "\n---------------------------------------\n" ); 138​ fwrite( $debug, "\n---------------------------------------\n" );
144 fclose($debug); 139​ fclose($debug);
145} 140​}
146?> 141​?>