Ogone changed SHA-policy [#886006]

I wrote a new implentation of the uc_ogone_return_ok function to handle the new policy, tell me if you find any bugs... I haven't used this on a production site yet, but I will be in the near future.

There may be a bug or two in here, I just wrote it on the spot and it seems to work.

function uc_ogone_return_ok($auto = FALSE) {
  $sha_suffix = variable_get('ogone_sha1_signature_post', TRUE);
  
  $arguments = 
	array(
		'AAVCHECK' => trim($_GET['AAVCheck']),
		'ACCEPTANCE' => trim($_GET['ACCEPTANCE']),
		'AMOUNT' => trim($_GET['amount']),
		'BRAND' => trim($_GET['BRAND']),
		'CARDNO' => trim($_GET['CARDNO']),
		'CCCTY'=> trim($_GET['CCCTY']),
		'CN' => trim($_GET['CN']),
		'CURRENCY' => trim($_GET['currency']),
		'CVCCHECK' => trim($_GET['CVCCheck']),
		'ECI' => trim($_GET['ECI']),
		'ED' => trim($_GET['ED']),
		'IP' => trim($_GET['IP']),
		'IPCTY' => trim($_GET['IPCTY']),
		'NCERROR' => trim($_GET['NCERROR']),
		'ORDERID' => trim($_GET['orderID']),
		'PAYID' => trim($_GET['PAYID']),
		'PM' => trim($_GET['PM']),
		'STATUS' => trim($_GET['STATUS']),
		'TRXDATE' => trim($_GET['TRXDATE']),
		'VC' => trim($_GET['VC'])
		);
		
  $sha1_return_key=strtoupper($_GET['SHASIGN']);
  
  $sha1_key='';
  
  foreach ($arguments as $param_name => $param_value)
  {
	$param_value = trim($param_value);
	$param_name = strtoupper($param_name);
	if (strlen($param_value) > 0) {
		$sha1_key .= $param_name.'='.$param_value.$sha_suffix;
	}
  }
  
  $sha1_key = strtoupper(sha1($sha1_key));
  
  //Uncomment for manual SHA comparison for debug purposes
  // echo $sha1_return_key.'<br>'.$sha1_key;
  // exit;

  if(($sha1_key == $sha1_return_key) && (($arguments['STATUS'] == 5) || ($arguments['STATUS'] == 9))){
    db_query("INSERT INTO {uc_payment_ogone} (order_id, description, payment_method, order_status, sha1_test_succes) VALUES ('%d','%s','%s','%s','%s')", $arguments['ORDERID'], 'Back-office' ,$arguments['PM'], $arguments['STATUS'], 'OK');
    if(!$auto){
      drupal_goto('cart/ogone_ok');
    }
  }else{
    if(!$auto){
      drupal_goto('cart/ogone_false');
    }
  }
}

I also had to adjust uc_ogone_call

function uc_ogone_call(&$arg1, $arg2) {

  /*global $user; //Todo: find a way to detect user language
  if (!($user->language)) {
    $language = 'en_US';
  }

  $currency_sign = substr(htmlspecialchars(uc_currency_format('0')),0,3);
  $currency_sign = htmlspecialchars($currency_sign);

  switch($currency_sign) { //This needs review! Doesn't work properly
    case '$':
      $currency = 'USD';
      break;

    case '£':
      $currency = 'GBP';
      break;

    //case "€":
    default:
      $currency = 'EUR';
      break;
  }*/ //Disabled KK 180608, autodetection needs work

  //$ogone_url = 'https://secure.ogone.com/ncol/prod/orderstandard.asp';
  $ogone_url = filter_xss(variable_get('ogone_url', TRUE));

  //Set base url
  // if (function_exists('i18n_get_lang')){
  //  $url_base = current(parse_url($_SERVER['HTTP_REFERER'])).'://'.$_SERVER['HTTP_HOST'].'/'.i18n_get_lang();
  // }
  // else{
  //  $url_base = current(parse_url($_SERVER['HTTP_REFERER'])).'://'.$_SERVER['HTTP_HOST'];
  // }
  
  $url_base = current(parse_url($_SERVER['HTTP_REFERER'])).'://'.$_SERVER['HTTP_HOST'].url();

  $pspid = filter_xss(variable_get('ogone_pspid_id', TRUE));
  $orderid = $arg1->order_id;
  $amount = round($arg1->order_total * 100);   //amount *100

  $currency = filter_xss(variable_get('ogone_currency', TRUE));
  $language = filter_xss(variable_get('ogone_language', 'en_US'));

  $layout_title = filter_xss(variable_get('ogone_layout_title', TRUE));
  $layout_bgcolor = filter_xss(variable_get('ogone_layout_bgcolor', TRUE));
  $layout_txtcolor = filter_xss(variable_get('ogone_layout_txtcolor', TRUE));
  $layout_tblbgcolor = filter_xss(variable_get('ogone_layout_tblbgcolor', TRUE));
  $layout_tbltxtcolor = filter_xss(variable_get('ogone_layout_tbltxtcolor', TRUE));
  $layout_buttonbgcolor = filter_xss(variable_get('ogone_layout_buttonbgcolor', TRUE));
  $layout_buttontxtcolor = filter_xss(variable_get('ogone_layout_buttontxtcolor', TRUE));
  $layout_logo = filter_xss(variable_get('ogone_layout_logo', TRUE));
  $layout_fonttype = filter_xss(variable_get('ogone_layout_fonttype', TRUE));
  $layout_template = $url_base.'/ogone_template_call';

  $redirect_accepturl = $url_base.'/cart/ogone_ok';
  $redirect_declineurl = $url_base.'/cart/checkout';
  $redirect_exceptionurl = $url_base.'/cart/checkout';
  $redirect_cancelurl = $url_base.'/cart/checkout/ogone_cancel';

  $order_description = str_replace('"', '', str_replace("'", '', 'Expert Delivery order: '.$arg1->order_id));
  $customer_name = str_replace('"', '', str_replace("'", '', $arg1->delivery_first_name.' '.$arg1->delivery_last_name));
  $customer_name = substr($customer_name, 0, 35); //Make sure this is < 35 char, else Ogone freaks out
  $customer_email = str_replace('"', '', str_replace("'", '', $arg1->primary_email));
  $brand = '';
  $pm = '';
  $customer_zip = str_replace('"', '', str_replace("'", '', $arg1->delivery_postal_code));
  $customer_address = str_replace('"', '', str_replace("'", '', $arg1->delivery_street1.' '.$arg1->delivery_street2.' '.$arg1->delivery_street2.' '.$arg1->delivery_city));

  $redirect_message1 = t('One moment please, you will automaticaly be redirected to the payment gateway...');
  $redirect_message2 = t('Popupblockers might stop the paymentpage from opening, please click the button to open the payment page if it does not open automaticaly.');
  $ogone_button_text = t('Click here to go to payment page manualy');

  // Disabled 060410 KK, duplicate?
  // $orderid = $arg1->order_id;
  // $amount = round($arg1->order_total * 100);   //amount *100

  $sha_suffix = variable_get('ogone_sha1_signature_pre', TRUE);

  $arguments = 
	array(
		'ACCEPTURL' => $redirect_accepturl,
		'AMOUNT' => $amount,
		'BGCOLOR' => $layout_bgcolor,
		'BRAND' => '',
		'BUTTONBGCOLOR' => $layout_buttonbgcolor,
		'BUTTONTXTCOLOR' => $layout_buttontxtcolor,
		'CANCELURL' => $redirect_cancelurl,
		'CATALOGURL' => $url_base.'/'.$catalog_url,
		'CN' => $customer_name,
		'COM' => $order_description,
		'CURRENCY' => $currency,
		'DECLINEURL' => $redirect_declineurl,
		'EMAIL' => $customer_email,
		'EXCEPTIONURL' => $redirect_exceptionurl,
		'FONTTYPE' => $layout_fonttype,
		'HOMEURL' => $url_base,
		'LANGUAGE' => $language,
		'LOGO' => $layout_logo,
		'ORDERID' => $orderid,
		'OWNERADDRESS' => $customer_address,
		'OWNERZIP' => $customer_zip,
		'PM' => '',
		'PSPID' => $pspid,
		'TBLBGCOLOR' => $layout_tblbgcolor,
		'TBLTXTCOLOR' => $layout_tbltxtcolor,
		'TITLE' => $layout_title,
		'TP' => $layout_template,
		'TXTCOLOR' => $layout_tbltxtcolor
	);
  
  $sha1_signature = '';

  $_SESSION['ogone_order_id'] = $arg1->order_id;
  $_SESSION['ogone_form']='
  <div class="ogone_redirect_message_top">
  '.$redirect_message1.'
  </div>
  <div class="ogone_redirect_container">
  <div align="center" class="ogone_redirect_form">
  <FORM METHOD="post" ACTION="'.$ogone_url.'" id="ogone_form" name="ogone_form"  '. /*target="ogone_popup" */ 'onsubmit="">';
  
  foreach ($arguments as $param_name => $param_value)
  {
	$param_value = trim($param_value);
	$param_name = strtoupper($param_name);
	if (strlen($param_value) > 0) {
		$sha1_signature .= $param_name.'='.$param_value.$sha_suffix;
		$_SESSION['ogone_form'] .= '<INPUT type="hidden" NAME="'.$param_name.'" VALUE="'.$param_value.'" />';
	}
  }
  
  $_SESSION['ogone_form'] .= '
  <INPUT type="hidden" NAME="SHASign" value="'.sha1($sha1_signature).'">
  <input type="submit" value="'.$ogone_button_text.'" id="submit2" name="submit2" />
  </form>
  <script language="JavaScript">
  document.ogone_form.submit();
  </script>
  </div>
  <div class="ogone_redirect_message_bottom">
  '.$redirect_message2.'
  </div>
  </div>'
  ;
  drupal_goto('cart/checkout/ogone_redirect');
}

I also made some other adjustments, like how $url_base gets set; to support the Content Translation module.

Tell me what you think.

Comment	File	Size	Author
#27	ug_ogone-886006.patch	4.7 KB	drumm
#23	new-ogone-SHA1-policy.png	47.39 KB	wasare
#22	20110308_strip_double_slashes_append_logo_into_template.patch	1.97 KB	wasare
#2	20100920_new_sha1_calculation.patch	8.15 KB	pieterdc

Comments

Comment #1

keesje commented 7 September 2010 at 17:46

waiting for community review. Please provide a valid patch to get this in.

Comment #2

pieterdc

Dutch

Ghent

commented 20 September 2010 at 08:06

Version:	6.x-1.7	» 6.x-1.8
Priority:	Normal	» Critical
Status:	Active	» Needs review

Status	File	Size
new	20100920_new_sha1_calculation.patch	8.15 KB

I converted stophr's code into a patch against the 6.x-1.8 version.
I didn't include the extra string replace functions to filter out double and single quotes as I tried with a street name that starts with a single quote and didn't cause an error...

Promoted this issue to critical as payments get completed on Ogone's side, but not on Ubercart's side, as this module thinks something is wrong while there isn't.

Comment #3

pol

Brussels

commented 27 September 2010 at 08:17

Hello,

Do we need this patch to get it working as it should now ?
I'm using the stable version and I always get 'unknown order/1/s/'

Thanks for helping !

Comment #4

bartnav commented 27 September 2010 at 19:31

Pol, the patch solves the 'unknown order/1/s/' error, but seems to introduce a new problem. See the "Problem with Return OK URL" issue for more information. I'm still waiting on a reply. I'm even considering a shift towards Magento at this point in time :(

Comment #5

pol

Brussels

commented 28 September 2010 at 10:23

So this module is useless at this time...

Have you find a workaround to get it working as it should ?

I think I will switch to Magento if I don't have any news from the maintainer, I hope I'll have soon...

Comment #6

Anonymous (not verified) commented 28 September 2010 at 10:31

Pol, are you testing on a host that is accessible by the internet?
Btw, the Magento "threat" is a bit pathetic.

Comment #7

pol

Brussels

commented 28 September 2010 at 10:52

Hello Joeph,

Don't take it as a threat, it wasn't my intention at all, I just want something's working for my client, any solution is good.

I will try the patch this afternoon and report my experience here.

Yes, the website is accessible on the net.

Comment #8

Anonymous (not verified) commented 28 September 2010 at 19:45

You can also request Ogone to switch back to the old policy for that account.

Comment #9

pol

Brussels

commented 29 September 2010 at 09:32

If I ask to switch to the old policy, the module will work out of the box ?

Comment #10

Anonymous (not verified) commented 29 September 2010 at 18:54

yes

Comment #11

nitebreed

Dutch

commented 8 October 2010 at 14:50

subscribing...

After applying this patch I still have the error unknown order/1/s/

Is there a way to have everything from Ogone erased from my database? I think that might be the problem...

Comment #12

pieterdc

Dutch

Ghent

commented 27 October 2010 at 08:22

Did you supply a SHA-1 Signature in both your Drupal module configuration and the Ogone account settings page?

Comment #13

nitebreed

Dutch

commented 27 October 2010 at 09:32

Yeah I entered both SHA-1 Signatures (pré and post) in both Drupal and Ogone. But that didn't work. Therefore I called Ogone and asked them if they could turn the SHA-policy back for my account. So everything is working now, but with the old policy.

Comment #14

keesje commented 15 November 2010 at 13:04

Assigned:

Unassigned

» keesje

I tested patch in #2, applies valid and seems to work right.
Since I do not actively maintain any production project with this module, I wait for others to confirm this patch.
Please test and post back here.

Comment #15

keesje commented 15 November 2010 at 13:10

For D5, I will not roll this back to D5. This only applies on new ogone accounts, existing ones will keep the old policy AFAIK.

Comment #16

Michsk commented 4 February 2011 at 22:36

This patch didn't fix the unknown order/1/s/ error for me neither.

Comment #17

cyberschorsch

German

commented 9 February 2011 at 13:58

I can confim that.

I did some research on his topic:

http://www.magentocommerce.com/boards/viewthread/69870/

I tried to check that problem with setting the In and Out (in ogone modul it is Pre and Post) he same, but the error still occurs. Any ideas?

Comment #18

Michsk commented 9 February 2011 at 20:31

Ok i moved all the selected options from the "Dynamic e-Commerce Parameters" in the "Transactionparameters feedback" tab to the left and then re-added them in the order as it is in the patch but still no result.

Comment #19

Michsk commented 9 February 2011 at 20:47

Ok, great. I got it working.

So i did what i said here above. And changed my SHA-key to a new one, re-checked it everywhere. And now it works.

Comment #20

bartezz commented 10 February 2011 at 10:39

Hey lasac,

Am having isues with unknown order/1/s/ too. Since you have it working could you please tell me the settings you have made on each tab in Ogone?

Here is what I have;

Global transaction parameters
Default operation code: sale
Payment retry: 10
Processing for individual transactions: Always online (immediate)
Global security parameters
Hash algorithm: SHA-1
Character encoding: UTF-8
Payment page layout
Back button redirection: http://my.drupalsite.com/cart/checkout
Data and origin verification
Checks for e-Commerce:
URL of merchant page: http://my.drupalsite.com/en/cart/checkout
SHA-IN Pass phrase: ###SHA-1 Signature pre###
Transaction feedback
CHECKED I want to receive transaction feedback parameters on the redirection URLs
CHECKED I want Ogone to display a short text to the customer on the secure payment page if a redirection to my website is detected immediately after the payment process.
Timing of the request: always online
Request method: GET
Dynamic e-Commerce Parameters: (in following order)
[AAVCHECK; ACCEPTANCE; ; AMOUNT; BRAND; CARDNO; CCCTY; CN; CURRENCY; CVCCHECK; CI; ED; IP; IPCTY; NCERROR; ORDERID; PAYID; PM; STATUS; TRXDATE; VC]
CHECKED I want Ogone to display a "processing" message to the customer during payment processing.
SHA-OUT Pass phrase: ###SHA-1 Signature post###
Timing of the request: No request
Dynamic parameters: (in following order)
[NCERROR, ORDERID, PAYID, STATUS]
Transaction e-mails
E-mail address(es) for transaction-related e-mails: Yes, for all transaction submission modes.
Receive e-mails in case of offline transaction status changes: : No
Test info
Test Info: I want to simulate transaction results based on the amount.

Changed SHA1 a gazillion times but always getting unknown order/1/s/
It does show the correct Beneficiary but no amount....

Looking at the source of the uc_ogone secure checkout redirect page I get;

<FORM METHOD="post" ACTION="https://secure.ogone.com/ncol/test/orderstandard.asp" id="ogone_form" name="ogone_form"  onsubmit="">
  <INPUT type="hidden" NAME="ACCEPTURL" VALUE="http://my.drupalsite.com/en/cart/ogone_return_ok" />
  <INPUT type="hidden" NAME="AMOUNT" VALUE="5348" />
  <INPUT type="hidden" NAME="CANCELURL" VALUE="http://my.drupalsite.com/en/cart/checkout/ogone_cancel" />
  <INPUT type="hidden" NAME="CATALOGURL" VALUE="http://my.drupalsite.com/en/" />
  <INPUT type="hidden" NAME="CN" VALUE="Customer Name" />
  <INPUT type="hidden" NAME="COM" VALUE="My Webshop order: 21" />
  <INPUT type="hidden" NAME="CURRENCY" VALUE="EUR" />
  <INPUT type="hidden" NAME="DECLINEURL" VALUE="http://my.drupalsite.com/en/cart/checkout" />
  <INPUT type="hidden" NAME="EMAIL" VALUE="customer@mail.com" />
  <INPUT type="hidden" NAME="EXCEPTIONURL" VALUE="http://my.drupalsite.com/en/cart/checkout" />
  <INPUT type="hidden" NAME="HOMEURL" VALUE="http://my.drupalsite.com/en" />
  <INPUT type="hidden" NAME="LANGUAGE" VALUE="en_US" />
  <INPUT type="hidden" NAME="ORDERID" VALUE="41" />
  <INPUT type="hidden" NAME="OWNERADDRESS" VALUE="CustomerStreet CustomerCity />
  <INPUT type="hidden" NAME="OWNERZIP" VALUE="CustomerZIP" />
  <INPUT type="hidden" NAME="PSPID" VALUE="pspid" />
  <INPUT type="hidden" NAME="TITLE" VALUE="Secure Checkout" />
  <INPUT type="hidden" NAME="TP" VALUE="http://my.drupalsite.com/en/ogone_template_call" />
  <INPUT type="hidden" NAME="SHASign" value="kj1ljk12lkj12lkj12klj12lkj12lkj12">
  <input type="submit" value="Click here to go to payment page manualy" id="submit2" name="submit2" />
</form>

Help is very much appreciated!

Cheers

Comment #21

Michsk commented 10 February 2011 at 20:31

i will try to post this week how to do this. Did you allready check out the readme.txt?

Comment #22

wasare commented 8 March 2011 at 15:23

Version:

6.x-1.8

» 6.x-1.9

Status	File	Size
new	20110308_strip_double_slashes_append_logo_into_template.patch	1.97 KB

Hi,

I had some troubles with double slashes and logo image not displayed in test environment. The image works only on HTTPS environment and in production accounts, but append logo image into template worked fine for me (in test environment with new sha-policy).

The patch was attached.

Comment #23

wasare commented 14 March 2011 at 13:25

Status	File	Size
new	new-ogone-SHA1-policy.png	47.39 KB

I tested my patch in production and worked fine (the payment page loaded correctly).

The logo image load without HTTPS, directly on the template, it's sound great for me.

After contact Ogone Staff support to change the account to new SHA1-policy a new option is avaliable on "Global security parameters" at "Technical information" you'll have set "Each parameter followed by the pass phrase.", to use new validation schema. See attached image as refer.

Comment #24

bartezz commented 17 March 2011 at 13:46

#22 patch didn't work for me...

But I did find the problem in my case... Had a DUH!!!! moment...

In Transaction feedback tab I entered the url from which the transactions would come. And I forgot to enter all multilinguel paths. So http://mysite.com/en/cart/checkout;http://mysite.com/ln/cart/checkout;ht...

That did it...

Further more I got a php/mysql error about inserting the query twice. This patch solved that; http://drupal.org/node/926772

Cheers

Comment #25

pieterdc

Dutch

Ghent

commented 17 March 2011 at 20:21

Just saying; normally, you don't need to enter any url in Ogone's backend.
It's quite well documented in this module's README.txt file.

Comment #26

Anonymous (not verified) commented 31 March 2011 at 15:32

The error unknown order/1/s/ can also be caused by special characters like "üöä" in user names or description. The default Ogone gateway is ISO, not UTF-8. A workaround I use is Ogone's special UTF-8 URL:

https://secure.ogone.com/ncol/orderstandard_utf8.asp

Making sure my HTML form is UTF-8 as well.

Comment #27

drumm

he/him

NY, US

commented 15 April 2011 at 01:17

Status	File	Size
new	ug_ogone-886006.patch	4.7 KB

The account I'm using is stuck on the old SHA checking, a 3rd-party service on the same Ogone account seems to requires it. The attached patch allows switching in the admin UI. Tested with the older hashing, but not the newer.

Comment #28

drumm

he/him

NY, US

commented 29 April 2011 at 19:28

Status:

Needs review

» Fixed

I committed #27.

There are a few issues being reported here. utf8 is not related to SHA policies, we might want a separate issue to improve the UI. #1078722: Catalog url is not passed to Ogone. would help with double slashes. Please check other issues and file new ones for non-SHA problems.

Comment #29

arski commented 4 May 2011 at 21:54

moved to separate issue

Comment #30

18 May 2011 at 22:02

Status:

Fixed

» Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Comment #31

matthijs_hofstede commented 31 October 2012 at 12:02

I did some investigation on this issue. Looks like the SHA1 parameters are calculated as desired.

The unknown order/1/s/ message however still appears.

My conclusion is that Ogone calculates with another set off data it receives. I have seen some issues where the fields below cause problems with some hashes off PSP's. These are fields generated dynamicly by Drupal. Some info on removing them can be found here: http://drupal.org/node/821932

Note: These fields are generated with a reason. So i don't thik it is a good idea to remove them. Most Ogone implementation work with another external form that actualy submits the data to Ogone.

I am working hard to get this fixed but i could really use some help. So any feedback is appreciated.

Comment #32

matthijs_hofstede commented 2 November 2012 at 12:42

I tested the above and no result. After (to much) investigation i found my problems started with the order/1/s notification. After i fixed some things i got an order/1/r notification (notice the difference s and r). The order/1/r relates to the referrer. The conclusion was that i didn't have to fill a referrer URL.

Ogone changed SHA-policy

Comments

Comment #1

Comment #2

Comment #3

Comment #4

Comment #5

Comment #6

Comment #7

Comment #8

Comment #9

Comment #10

Comment #11

Comment #12

Comment #13

Comment #14

Comment #15

Comment #16

Comment #17

Comment #18

Comment #19

Comment #20

Comment #21

Comment #22

Comment #23

Comment #24

Comment #25

Comment #26

Comment #27

Comment #28

Comment #29

Comment #30

Comment #31

Comment #32

News items

Our community

Documentation

Drupal code base

Governance of community