Hi hswong3i et al,

I've been trying to decipher the way the PayDollar payment gateway confirms completion of a payment and updates the Ubercart order.

So without the datafeed set PayDollar provides just a success/failure/cancel URL with the order reference. The callbacks for each of these are quite straight forward with the success one just completing the order and marking payment as authorised.

However you can gain access to the success URL via the source code of the review order point. It means you could essentially just jump to that URL which has the order number included and this will mark the payment authorised and process the order. Essentially this is a spoof of the checkout process and leads to full checkouts without taking any payments..!

From my understanding the datafeed is therefore required to ensure the payment is checked and the order is processed correctly.. or failed or "errored". The alternative is that you can add a payment_received status check into the success function and then set the status in the datafeed function to this if the payment was successful.

However I'm also seeing a minor issue that with the datafeed successcode, the successful payment value is 0 and failure is 1, with error being any other type of response. I found that if I call the datafeed URL directly it returns a successful answer because 0 in a switch can also evaluate a FALSE or a single space if it's not a defined NULL. I've modified the switch to be a type specific if/elseif/else so that we are saying -

if ($successcode === 0) {

This requires the successcode value to be an integer and 0. Do you see any issues with this approach? Obviously calling the feed directly doesn't do anything as you would need to populate a $_POST array for the datafeed to use to process the order. So this part isn't critical as it's harder to spoof but the success URL issue negates most of this anyway.

Finally, I've had to ping PayDollar directly because my datafeed isn't being fired by the gateway payment process, i.e. before you are given a link back to Ubercart to complete the order. Has anyone else had issues with the feed just being called?

Sorry, realised I've said a lot above! I think there are a few checks that need to be added to the module for it to be a bit more solid in terms of the spoofing and ensuring an order is only processed fully if the datafeed has been called.

Any thoughts on this?
Thanks,
luke