66 function commerce_paypal_process_ipn($payment_method = NULL, $debug_ipn = array()) {
...
74     foreach ($ipn as $key => $value) {
75       $variables[] = $key . '=' . urlencode(stripslashes($value));
76     }

According to the Paypal Instant Payment Notification Guide p. 20, stripslashes should only be invoked on values when gpc_magic_quotes == 1 .

Drupal should already stripslashes automatically when this is the case.

CommentFileSizeAuthor
#1 commerce_paypal-stripslashes_and_gpc_magic_quotes_ipn-1570530-1.patch613 bytesandyg5000

Comments

andyg5000’s picture

andyg5000
Primary language English
Location North Carolina, USA
commented
Status: Active » Needs review
StatusFileSize
new commerce_paypal-stripslashes_and_gpc_magic_quotes_ipn-1570530-1.patch613 bytes

Patch attached

rszrama’s picture

rszrama commented
Status: Needs review » Fixed

Actually, I think the idea is that we don't need to worry about stripslashes() at all. _drupal_bootstrap_full() calls fix_gpc_magic(), which in turn walks over various superglobal arrays stripping slashes left and right. So looking at PayPal's example, everything they do to detect magic quotes is being done by Drupal automatically. We can simply remove the call to stripslashes() and be satisfied.

Commit: http://drupalcode.org/project/commerce_paypal.git/commitdiff/103ae02

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.