switching PayPal IPN Verification Postback to HTTPS

[moogawooga]

I have no problem with paypal using the 1.5.4 version of code

Indeed, at present there is no functional issue, and there wouldn't be one at least until 9/30/2016, irrespective of the zen-cart version (even 1.3.8 probably works fine).

I assume that either 1.5.5 will be released by then or there will be a patch to 1.5.4 that makes the above mentioned change. I just didn't want to wait until then (the store owners feel better if they doesn't see outstanding issues in the emails paypal sends them), but you certainly could.

[mc12345678]

Indeed, at present there is no functional issue, and there wouldn't be one at least until 9/30/2016, irrespective of the zen-cart version (even 1.3.8 probably works fine).

I assume that either 1.5.5 will be released by then or there will be a patch to 1.5.4 that makes the above mentioned change. I just didn't want to wait until then (the store owners feel better if they doesn't see outstanding issues in the emails paypal sends them), but you certainly could.

Fwiw, recent post by ZC core team member is that basically provided nothing significant comes up in the very near future, ZC 1.5.5 is expected to be released by next Wednesday.

[s_mack]

Has this been addressed? I got this from PayPal:

Reminder: REQUIRED to avoid service interruptions you need to complete important security upgrades.

Every day, hundreds of millions of people use PayPal to manage and move money online or on a mobile device. That’s why one of our top priorities is to ensure our customers have a safe, secure experience when transacting with PayPal.

This year, we’ve made a number of upgrades to the PayPal system enabling us to continue providing the highest level of security available for customers. Throughout 2018, we will continue to upgrade our security protocols to the highest levels of protection available, which includes moving all of our systems to TLS 1.2, an enhanced security protocol that encrypts customer data over the Internet. We also announced several new security requirements for merchants who use PayPal, to ensure they do their part to protect sensitive customer data, as well.

Our records indicate that you still need to make critical security upgrades to your systems. If you see a “YES” next to a security change, your integration must be updated to accept these new security measures as soon as possible.


Change Change Required?
Merchant API Certificate Credential Upgrade No
TLS 1.2 and HTTP/1.1 Upgrade No
IPN Verification Postback to HTTPS Yes
Discontinue Use of GET Method of Classic NVP/SOAP No

I Googled the highlighted term and got this page. I'm using 1.5.4. They appear to be giving a deadline of June 2018.

[DrByte]

Has this been addressed?

I'm using 1.5.4.

Ya, it was addressed in December 2015 as part of the v1.5.5 release preparation:
https://github.com/zencart/zencart/c...069a145c8844ca

[s_mack]

Thanks.