view release on metacpan or  search on metacpan

lib/Business/OnlinePayment/IPayment/Response.pm  view on Meta::CPAN

=head3 validation_errors

With this accessor you are able to lookup the validation errors found

=cut

has validation_errors => (is => 'rwp');

sub _add_valid_error {
    my $self = shift;
    my $error = shift;
    my $olderr = $self->validation_errors || "";
    $self->_set_validation_errors($olderr . " " . $error);
}

sub is_valid {
    my $self = shift;
    # clear the error stack
    $self->_set_validation_errors("");
    unless ($self->ret_param_checksum) {
        $self->_set_validation_errors("No checksum provided!");
        return 0;
    }

    die "Validation asked, but you didn't provide the security key!\n"
      unless $self->my_security_key;
    
    
    unless ($self->my_amount) {
        $self->_add_valid_error("Using the data passed by the server!");
        $self->my_amount($self->trx_amount);
    }
    unless ($self->my_currency) {
        $self->_add_valid_error("Using the currency passed by the server!");
        $self->my_currency($self->trx_currency);
    }
    unless ($self->my_userid) {
        $self->_add_valid_error("Using the userid passed by the server!");
        $self->my_userid($self->trxuser_id);
    }
    
    my $expectedhash = md5_hex($self->my_userid .
                               $self->my_amount .
                               $self->my_currency .
                               $self->ret_authcode .
                               $self->ret_booknr .
                               $self->my_security_key);
    if ($expectedhash eq $self->ret_param_checksum) {
        return "OK"
    }
    else {
        $self->_add_valid_error("Expected hash $expectedhash isn't " . $self->ret_param_checksum);
        return 0;
    }
}


=head3 raw_url 

Accessor for the raw, undecoded url (used for the checksum).

=cut


has raw_url => (is => 'rw');



=head3 url_is_valid($raw_undecoded_url)

You may ask for the validation of the url, which comes with a checksum
attached. For this you should have already provided the security key
and you should pass the raw undecoded url as argument.

Alternatively, if you set the attribute C<raw_url> in the constructor
or with the accessor, you can call url_is_valid without arguments.

Return false on failure, true on success

Original German doc (left in place because the translation was drunk).

CGI-Name: ret_url_checksum 
Webservice-Name: - (nicht benötigt) 
Datentyp: String 

Wenn Sie für eine Transaktion eine Anwendung mit einem Security-Key
verwendet haben, wird dieser Parameter mit einem MD5-Hash an die
Rücksprungs-URL angehängt.

Für die Bildung des Hash wird an die Rücksprungs-URL ein & und der
Transaktions-Security- Key der Anwendung angehängt. Für diese
Zeichenkette wird die MD5-Prüfsumme generiert. Der ermittelte Hash
wird als Parameter ret_url_checksum an die Rücksprungs-URL hinter alle
anderen Parameter an das Ende angehängt.

Um die Prüfsumme zu überprüfen müssen Sie den Parameter
ret_url_checksum von der vollständigen URL des aufgerufenen Scriptes
abschneiden, den Transaktions-Security-Key anhängen und dann die
MD5-Prüfsumme ermitteln. Wenn die Prüfsumme nicht mit dem Wert des
Parameters ret_url_checksum übereinstimmt, liegt vermutlich eine
Manipulation der URL vor.

=cut

sub url_is_valid {
    my ($self, $url) = @_;
    unless ($url) {
        $url = $self->raw_url;
    }
    # clear the error stack;
    $self->_set_validation_errors("");
    $self->_set_validation_errors("Missing url for url validation")
      unless $url;
    $self->_add_valid_error("Missing secret key for url validation")
      unless $self->my_security_key;
    unless ($url and $self->my_security_key) {
        return 0
    }

    my $checksum;
    # warn $url;
    # unclear if the & should be removed 
    if ($url =~ m/&ret_url_checksum=([A-Za-z0-9]+)$/) {
        $checksum = $1;
        # it looks like the trailing & should be left in place
        $url =~ s/ret_url_checksum=([A-Za-z0-9]+)$//
    } else {
        $self->_add_valid_error("checksum not found\n");
        return 0
    }
    my $ourchecksum = md5_hex($url . $self->my_security_key);
    if ($ourchecksum eq $checksum) {
        return "OK";