Support

August 11, 2012 at 10:48 am

I have discovered several problems in the authorize.net SIM processing code. The version I was looking at was 3.1.26. In Authorize.php the existing code looks like this:

        public function validateIpn() {
            foreach ($_POST as $field => $value) {
                    $this->ipnData["$field"] = $value;
            }
            $invoice = intval($this->ipnData['x_invoice_num']);
            $pnref = $this->ipnData['x_trans_id'];
            $amount = doubleval($this->ipnData['x_amount']);
            $result = intval($this->ipnData['x_response_code']);
            $respmsg = $this->ipnData['x_response_reason_text'];
            $md5source = $this->secret . $this->login . $this->ipnData['x_trans_id'] . $this->ipnData['x_amount'];
            $md5 = md5($md5source);
            if ($result == '1') {
                    // Valid IPN transaction.
                    $this->logResults(true);
                    return true;
            } else if ($result != '1') {
                    $this->lastError = $respmsg;
                    $this->logResults(false);
                    return false;
            } else if (strtoupper($md5) != $this->ipnData['x_MD5_Hash']) {
                    $this->lastError = 'MD5 mismatch';
                    $this->logResults(false);
                    return false;
            }
    }

The testing of $result is wrong. It’s either “1” or it isn’t, so the md5 check is never done. In addition, it is returns false whenever $result is not “1” (ie: not a successful transaction) so the code in authnet_ipn.php where the call is made from, never has a chance to display the cause of the problem properly (it displays (IPN response did not validate) instead, which is not necessarily true.) To fix this problem I have re-written the function as follows:

        public function validateIpn() {
            foreach ($_POST as $field => $value) {
                    $this->ipnData["$field"] = $value;
            }
            $invoice = intval($this->ipnData['x_invoice_num']);
            $pnref = $this->ipnData['x_trans_id'];
            $amount = doubleval($this->ipnData['x_amount']);
            $result = intval($this->ipnData['x_response_code']);
            $respmsg = $this->ipnData['x_response_reason_text'];
            $md5source = $this->secret . $this->login . $this->ipnData['x_trans_id'] . $this->ipnData['x_amount'];
            $md5 = md5($md5source);
            if (strtoupper($md5) != $this->ipnData['x_MD5_Hash']) {
                    $this->lastError = 'MD5 mismatch';
                    $this->logResults(false);
                    return false;
            }
            $this->logResults(true);
            return true;
    }

This seems to work just fine. Please confirm and add to your next release. As the md5 transaction ID is never getting checked right now, this is a security issue.

Also there is a benign typo in authnet_ipn.php on line 85:

<strong>Error:</strong> (IPN response did not validate) ?>

The ?> doesn’t belong there.

Hope this helps!

• This topic was modified 11 years, 8 months ago by  Colin Stearman.
• This topic was modified 11 years, 8 months ago by  Seth Shoultes. Reason: Moving to correct forum