Today, Paypal sent me a note telling me that my Drupal Commerce site would start having issues in June unless I fixed a few things. It seems like a good idea to open an issue and begin a discussion about what we need to do.

Here's what Paypal said I needed to fix.

  • SSL Certificate Upgrade to SHA-256 Yes
  • TLS 1.2 and HTTP/1.1 Upgrade Yes
  • IPN Verification Postback to HTTPS No
  • IP Address Update for PayPal Secure FTP Servers No
  • Merchant API Certificate Credential Upgrade No
  • Discontinue Use of GET Method for Classic NVP/SOAP APIs No

Paypal offered more documentation here.

Some of these are being addressed. There's some work on TLS here .

Comments

bogdog400 created an issue. See original summary.

joleenshook’s picture

joleenshook commented

Is it necessary to perform the TLS1.2 and SSL Cert update if you're running Paypal WPS on a non SSL site?? I'm not currently running SSL on this website, and everything seems to be working fine. Customers are redirected to Paypal for checkout and then back to the site when it's complete.

I'm running 7.x-2.2, if that makes a difference. Haven't wanted to upgrade to 7.x-2.3, as there seems to be a number of open issues on it.

andrej galuf’s picture

andrej galuf commented

I've had to face this yesterday when I started working on the PayPal Plus submodule - core drupal_http_request won't work anymore, because it doesn't support HTTP/1.1

There's three possible directions here:

  1. Replace drupal_http_request with CURL,
  2. Add dependency to cURL HTTP Request and use that as a drop-in replacement for drupal_http_request
  3. Add Composer Manager dependency and rebuild the module using PayPal's SDK

As a short term solution, Option 2 is the fastest and simplest and requires no module adjustments.
As a long-term solution though, we should go with Option 3, else we'll have to rebuild it all in a few months anyway when Commerce 2.0 is out.

bojanz’s picture

bojanz commented

@Andrej Galuf
The PayPal SDK is Apache2 licensed, which means it's incompatible with GPL2 and can't be included inside any distribution on drupal.org.
That's a deal breaker for D7 at least (for D8 we could just package Commerce/Kickstart on drupalcommerce.org).

So that leaves #1, #2 or requiring Guzzle as the valid options.

elc’s picture

elc commented

Sandbox IPNs no longer work without using HTTP/1.1. Work around is to manually configure cURL module #2263585: Paypal enforcing HTTP/1.1 on sandbox - update client method.

If you're unlucky and your server's version of curl is out of date, then a hacky solution is the way to go.

rreiss’s picture

rreiss commented
Status: Active » Closed (duplicate)

Duplicate to https://www.drupal.org/node/2263585 .