Need help. PAYPAL problem after upgrade to 1.3.9d

[wilorc]

I have receive an update from PayPal as follows:

My name is Juan, and I am with PayPal Merchant Technical Services. Your issue has been escalated to my team. Our logs show that you are submitting the Notify_url paramater as URL encoded value


EPEP5BF2E64E: request from your system

SHIPTONAME=**** ****&SHIPTOSTREET=********* 25&SHIPTOCITY=Melbu&SHIPTOSTATE=Norway&SHIPTOZIP=8445&SHIPTOCOUNTRYCODE=&BUTTONS OURCE=ZenCart-EC_uk&RETURNFMFDETAILS=0&CUSTOM=EC-4352-1276881127&INVNUM=4352-1276881127-[*******]&CURRENCY=GBP&AMT=29.50&TOKEN=EC-90F44899BF450051M&PAYERID=YFHSHJ4LYGVRY&ACTION=D&TENDER=P&TRXTYPE=S&NOTIFYURL=ht tps%3A%2F%2Fwww.********.com%2Fipn_main_handler.php&REQUEST_ID=1276881127&USER=L W2GLPE3FD&PWD=8XXXXXXXXXXXXXXZ&PARTNER=PayPalUK&VENDOR=**********

as you can see we are receiving the value encoded.

per our documentation https://cms.paypal.com/cms_content/U...r/IPNGuide.pdf on page 11
"PayPal generates an IPN message when you invoke an API operation, such as
DoExpressCheckoutPayment or DoDirectPayment ..."

This means that IPN will send back the contents of what our system received from DoExpressCheckoutPayment or DoDirectPayment ..." and not the SetExpressCheckout call.

IPNs return the your raw request string back and does not apply any decoding to it.

So, notification URL for PayPal Express payments is being URL encoded by the Zen Cart store, and PayPal do not (and should not) URL de-code, so IPN messages fail. Shouldn't it be the same as for Website Payment Pro, where the NOTIFY URL is not URL encoded, and subsequently succeeds??

[DrByte]

What's your PayPal ticket number?

And WHEN did this problem first start happening?

It's looking suspiciously as though PayPal changed something in their system recently, which is breaking how it's worked for years.

And it's also looking like it's specific to Express Checkout cases when using their Payflow engine (Pro 2.0) to submit EC transactions.

As far as whether Zen Cart url-encodes the NOTIFYURL ... it MUST be urlencoded, or it can't be submitted, since it contains characters that MUST be encoded for transmission. PayPal specifically says this in their docs, too.

[wilorc]

The "Question Reference" or Incident number is #100617-000022. I can PM login credentials, or any other information, if you require. PayPal have marked the ticket as "Solved", but it can still be re-opened and updated.

[DrByte]

Ya, it can be opened again within 1 day or something after they mark it closed.

Post back to it and ask them to explain why there's a difference in how they handle the NOTIFYURL when it's submitted exactly the same for Express Checkout as it is for DoDirectPayment for you as a UK merchant?

[DrByte]

wilorc, you first posted about this here on June 15.
When did the EC IPNs first start failing on you?
And what version of ZC were you using on that date?
What date did you upgrade from the prior release?

[wilorc]

I first noticed this problem when I upgraded to 1.3.9x, but previously I had been using a different PayPal account for Express payments because my Website Payments Pro account would not accept Maestro payments by PayPal Express, due to 3d Secure not being available in 1.3.8x. Therefore, I had my website payments pro account for credit card payments (Maestro card payments failing) and with IPN switched on, and I had a separate standard PayPal account for PayPal Express which did allow Maestro Express payments, but it did not have IPN switched on. Sorry for the long answer. The short answer is I first noticed when I had IPN active for express payments, which was 5th June 2010 when I upgraded everything to 1.3.9x and was able to have everything running through the one PayPal account again.

I have opened the ticket again, with the following update:

Can you please explain why there's a difference in how PayPal handle the NOTIFYURL for Express Checkout and DoDirectPayment? For me as a UK merchant I submit NOTIFYURL exactly the same for Express Checkout as I do for DoDirectPayment, and yet you (PayPal) are handling it differently. Why?

[wilorc]

I have received the following update from PayPal

In my previous correspondence, I submitted the raw string request we received from your system. It indicates that the notify URL was encoded before reaching our system. In the transactions that you listed which you say are correct. I don't see that your system is passing the notifyurl at all, which would default to the one on your profile which is not url encoded. The example I looked at was 8S227546F8939963A

[DrByte]

Try using the attached updated file (after unzipping of course):

[wilorc]

Thanks Dr. Byte. That worked perfectly. IPN sent correctly.

Many thanks.

[DrByte]

Thanks for the update.
We'll do some more regression testing and include this (and some others) in v1.3.9e.