Index: uc_payflowlink.module
===================================================================
--- uc_payflowlink.module	(revision 5752)
+++ uc_payflowlink.module	(working copy)
@@ -101,6 +101,12 @@
         '#description' => t('Specify your processing partner. Example: PayPal.'),
         '#default_value' => variable_get('uc_payflowlink_partner', ''),
       );
+     $form['uc_payflowlink_secret_token'] = array(
+        '#type' => 'textfield',
+        '#title' => t('Secret Token'),
+        '#description' => t('Secret token appended to the end of your post url.  This must be updated in the PayPal manager to match.'),
+        '#default_value' => variable_get('uc_payflowlink_secret_token', ''),
+      );      
       $form['uc_payflowlink_type'] = array(
         '#type' => 'select',
         '#title' => t('Transaction Process Mode'),
@@ -189,28 +195,36 @@
 
 // Handles the response sent by Payflow Link.
 function uc_payflowlink_response() {
-  if (variable_get('uc_payflowlink_watchdog', TRUE)) {
-    watchdog('uc_payflowlink', 'Order !order_id response received: !message<p>!details', array('!order_id' => intval($_POST['INVOICE']), '!message' => check_plain($_POST['RESPMSG']), '!details' => '<pre>'. print_r($_POST, TRUE) .'</pre>'));
-  }
+  $url = explode('/',$_SERVER['REQUEST_URI']);
+  $secret_token = $url[3];
 
-  $order_id = intval($_POST['INVOICE']);
+  if ($secret_token == variable_get('uc_payflowlink_secret_token', '')) {	    if (variable_get('uc_payflowlink_watchdog', TRUE)) {
+      watchdog('uc_payflowlink', 'Order !order_id response received: !message<p>!details', array('!order_id' => intval($_POST['INVOICE']), '!message' => check_plain($_POST['RESPMSG']), '!details' => '<pre>'. print_r($_POST, TRUE) .'</pre>'));
+    }
 
-  if (($order = uc_order_load($_POST['INVOICE'])) !== FALSE && $order->created == $_POST['USER1']) {
-    if ($_POST['RESULT'] == 0) {
-      uc_order_update_status($orderid, uc_order_state_default('post_checkout'));
-      $data = array(
-        'PNREF' => $_POST['PNREF'],
-        'AUTHCODE' => $_POST['AUTHCODE'],
-      );
-      $comment = t('PNREF: !pnref<br />AUTHCODE: !authcode', array('!pnref' => check_plain($_POST['PNREF']), '!authcode' => check_plain($_POST['AUTHCODE'])));
-      uc_payment_enter($order_id, 'payflowpro', $_POST['AMOUNT'], 0, $data, $comment);
-      uc_order_comment_save($order_id, 0, t('Payment of !amount submitted through Payflow Link.', array('!amount' => uc_currency_format($_POST['AMOUNT']))));
-      uc_cart_empty($_POST['USER2']);
+    $order_id = intval($_POST['INVOICE']);
+
+    if (($order = uc_order_load($_POST['INVOICE'])) !== FALSE && $order->created == $_POST['USER1']) {
+      if ($_POST['RESULT'] == 0) {
+        uc_order_update_status($orderid, uc_order_state_default('post_checkout'));
+        $data = array(
+          'PNREF' => $_POST['PNREF'],
+          'AUTHCODE' => $_POST['AUTHCODE'],
+        );
+        $comment = t('PNREF: !pnref<br />AUTHCODE: !authcode', array('!pnref' => check_plain($_POST['PNREF']), '!authcode' => check_plain($_POST['AUTHCODE'])));
+        uc_payment_enter($order_id, 'payflowpro', $_POST['AMOUNT'], 0, $data, $comment);
+        uc_order_comment_save($order_id, 0, t('Payment of !amount submitted through Payflow Link.', array('!amount' => uc_currency_format($_POST['AMOUNT']))));
+        uc_cart_empty($_POST['USER2']);
+      }
+      else {
+        uc_order_comment_save($order_id, 0, t('A Payflow Link payment failed.<br />Reason: !reason', array('!reason' => check_plain($_POST['RESPMSG']))));
+      }
     }
-    else {
-      uc_order_comment_save($order_id, 0, t('A Payflow Link payment failed.<br />Reason: !reason', array('!reason' => check_plain($_POST['RESPMSG']))));
-    }
   }
+  else {
+    watchdog('uc_payflowlink', 'Unauthorized access of Payflow Link Post for order !order_id ', array('!order_id' => intval($_POST['INVOICE']), '!message' => check_plain($_POST['RESPMSG']), '!details' => '<pre>'. print_r($_POST, TRUE) .'</pre>'));
+    drupal_access_denied();
+  }  
 }
 
 function uc_payflowlink_complete() {