diff --git a/payment/uc_authorizenet/uc_authorizenet.install b/payment/uc_authorizenet/uc_authorizenet.install index 7ac8d892..b1d41e0a 100644 --- a/payment/uc_authorizenet/uc_authorizenet.install +++ b/payment/uc_authorizenet/uc_authorizenet.install @@ -22,6 +22,12 @@ function uc_authorizenet_requirements($phase) { $requirements['uc_authorizenet_curl']['description'] = $t("Authorize.net requires the PHP cURL library.", array('!curl_url' => 'http://php.net/manual/en/curl.setup.php')); } + $hash = variable_get('uc_authnet_sha2_hash', FALSE); + if ($hash === FALSE) { + $requirements['uc_authorizenet_sha2_hash']['severity'] = REQUIREMENT_WARNING; + $requirements['uc_authorizenet_sha2_hash']['description'] = $t("Ubercart's Authorize.net Signature Key needs to be set in the payment settings.'", array('!hash_url' => url('admin/store/settings/payment/method/credit'))); + } + return $requirements; } @@ -41,3 +47,11 @@ function uc_authorizenet_uninstall() { function uc_authorizenet_update_last_removed() { return 3; } + +/** + * Remove deprecated MD5 hash variable. + */ +function uc_authorizenet_update_7301(&$sandbox) { + variable_del('uc_authnet_md5_hash'); +} + diff --git a/payment/uc_authorizenet/uc_authorizenet.module b/payment/uc_authorizenet/uc_authorizenet.module index 45eafdd1..4fd02b50 100644 --- a/payment/uc_authorizenet/uc_authorizenet.module +++ b/payment/uc_authorizenet/uc_authorizenet.module @@ -124,11 +124,11 @@ function uc_authorizenet_settings_form($form, &$form_state) { ), '#default_value' => variable_get('uc_authnet_arb_mode', 'disabled'), ); - $form['arb_settings']['uc_authnet_md5_hash'] = array( + $form['arb_settings']['uc_authnet_sha2_hash'] = array( '#type' => 'textfield', - '#title' => t('MD5 Hash'), - '#description' => t('Note: You must first configure credit card encryption before setting this.
Enter the value here you entered in your Auth.Net account settings.'), - '#default_value' => $login_data['md5_hash'], + '#title' => t('Signature Key'), + '#description' => t('Note: You must first configure credit card encryption before setting this.
Enter the value here you entered in your Auth.Net account settings.
To generate a new hash'), + '#default_value' => $login_data['sha2_hash'], '#access' => user_access('administer credit cards'), ); $form['arb_settings']['uc_authnet_report_arb_post'] = array( @@ -181,9 +181,9 @@ function uc_authorizenet_payment_gateway_settings_submit($form, &$form_state) { // Setup our encryption object. $crypt = new UbercartEncryption(); - // Encrypt the Login ID, Transaction key, and MD5 Hash. - if (!empty($form_state['values']['uc_authnet_md5_hash'])) { - variable_set('uc_authnet_md5_hash', $crypt->encrypt($key, $form_state['values']['uc_authnet_md5_hash'])); + // Encrypt the Login ID, Transaction key, and SHA256 Hash. + if (!empty($form_state['values']['uc_authnet_sha2_hash'])) { + variable_set('uc_authnet_sha2_hash', $crypt->encrypt($key, $form_state['values']['uc_authnet_sha2_hash'])); } // Store any errors. @@ -965,16 +965,16 @@ function _uc_authorizenet_login_data() { return $data; } - $md5_hash = variable_get('uc_authnet_md5_hash', ''); + $sha2_hash = variable_get('uc_authnet_sha2_hash', ''); // If CC encryption has been configured properly. if ($key = uc_credit_encryption_key()) { // Setup our encryption object. $crypt = new UbercartEncryption(); - // Decrypt the MD5 Hash. - if (!empty($md5_hash)) { - $md5_hash = $crypt->decrypt($key, $md5_hash); + // Decrypt the SHA256 Hash. + if (!empty($sha2_hash)) { + $sha2_hash = $crypt->decrypt($key, $sha2_hash); } // Store any errors. @@ -982,8 +982,22 @@ function _uc_authorizenet_login_data() { } $data = array( - 'md5_hash' => $md5_hash, + 'sha2_hash' => $sha2_hash, ); return $data; } + +/** + * Implements hook_store_status(). + */ +function uc_authorizenet_uc_store_status() { + if (variable_get('uc_authnet_sha2_hash', FALSE) === FALSE) { + $statuses[] = array( + 'status' => 'warning', + 'title' => t('Authorize.net Signature'), + 'desc' => t('Authorize.net Signature Key should be configured to ensure there are no interruptions in functionality.'), + ); + } + return $statuses; +} diff --git a/payment/uc_authorizenet/uc_authorizenet.pages.inc b/payment/uc_authorizenet/uc_authorizenet.pages.inc index 9a7fe556..5196f63a 100644 --- a/payment/uc_authorizenet/uc_authorizenet.pages.inc +++ b/payment/uc_authorizenet/uc_authorizenet.pages.inc @@ -31,10 +31,10 @@ function uc_authorizenet_silent_post() { if ($arb) { // Compare our expected MD5 Hash against what was received. - $md5 = strtoupper(md5($login_data['md5_hash'] . $_POST['x_trans_id'] . $_POST['x_amount'])); + $sha2 = strtoupper(hash('sha256', $login_data['sha2_hash'] . $_POST['x_trans_id'] . $_POST['x_amount'])); // Post an error message if the MD5 hash does not validate. - if ($_POST['x_MD5_Hash'] != $md5) { + if ($_POST['x_SHA2_Hash'] != $sha2) { watchdog('uc_authorizenet', 'Invalid ARB payment notification received.', array(), WATCHDOG_ERROR); } // Otherwise, let other modules act on the data.