PHP Warning: Illegal string offset in linkpoint_api module

[mprough]

[11-Aug-2014 20:14:44 UTC] PHP Warning: Illegal string offset 'r_approved' in /home/xxx/public_html/153/includes/modules/payment/linkpoint_api.php on line 818
[11-Aug-2014 20:14:44 UTC] PHP Warning: Illegal string offset 'r_error' in /home/xxx/public_html/153/includes/modules/payment/linkpoint_api.php on line 818

PHP 5.4.31
Zen Cart 1.5.3

~Melanie

[DrByte]

Turns out those warnings only occur if a communications error happens. So, they're symptomatic of a deeper problem.

[mprough]

I realize that, but why are both approved and error being triggered?

The logged Linkpoint error is

Communication Result: 60 - SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

So if the communication is failed, then why would the log also trigger approved?

~Melanie

[mprough]

v1.5.0

$ch = curl_init ();
curl_setopt ($ch, CURLOPT_URL,$host);
curl_setopt ($ch, CURLOPT_POST, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $xml);
curl_setopt ($ch, CURLOPT_SSLCERT, $key);
curl_setopt ($ch, CURLOPT_CAINFO, $key);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt ($ch, CURLOPT_SSLVERSION, 3);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, true);

v1.5.3

$ch = curl_init ();
curl_setopt ($ch, CURLOPT_URL,$host);
curl_setopt ($ch, CURLOPT_POST, 1);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $xml);
curl_setopt ($ch, CURLOPT_SSLCERT, $key);
curl_setopt ($ch, CURLOPT_CAINFO, $key);
//    curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // NOTE: Leave commented-out! or set to TRUE!  This should NEVER be set to FALSE in production!!!!
curl_setopt ($ch, CURLOPT_SSLVERSION, 3);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, true);

So adding the lines

      curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, false);
      curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, false);

Back in make it successful transaction with NO other changes.

~Melanie

[lhungil]

I would strong caution against disabling certificate verification. Disabling verification opens the communications (with customer payment information) to man-in-the-middle attacks (and possibly other security concerns).

When the behavior you are reporting occurs, it usually indicates one of two things:

1. The payment gateway does not have a valid 3rd party signed certificate properly installed. This is a very rare case.
2. The hosting provider does not have the server properly configured to validate certificates (via cURL). Most times this means they have not installed a recent CA Certificate Bundle or cURL does is not configured to use installed CA Certificate Bundle... The hosting provider should be able to either update their bundle (and configure cURL server wide to use the bundle)... Or at least they should be able to tell you where the bundle is on their server (so you can add a CURLOPT_CAINFO or CURLOPT_CAPATH to the options for each call made by cURL).

[mprough]

Agreed... and I believe it is fixed by using the original lphp.php (http://cloud1.firstdata.com/download...06_api_php.zip)

So it would stand to reason that there is a bug somewhere in the Zen Cart version of lphp.php

~Melanie