PayPal IPN Verification Postback to HTTPS with v1.3.8

Currently checking to see what needs to be done to update the site.
But for now I need to fix the PayPal issue.

After setting $scheme to https:// I did a test order -> No problem.
So I received 4 new order that were paid with Paypal. 2 no issues. For the other 2 I received a payment notification (e-mail) from PayPal, but no new order in Zen-Cart? I havn't had this in the past years.
I copied a few lines from the log.

Mar 19 2016 12:19 -- IPN PROCESSING INITIATED. 
*** Originating IP: 173.0.81.1  notify.paypal.com
*** Browser/User Agent: PayPal IPN ( https://www.paypal.com/ipn )

Mar 19 2016 12:19 -- IPN INFO - POST VARS to be sent back for validation: 
To: ssl://www.paypal.com:443
POST /cgi-bin/webscr HTTP/1.1
Host: www.paypal.com
Content-type: application/x-www-form-urlencoded
Content-length: 827
Connection: close

Mar 19 2016 12:19 -- IPN INFO - Confirmation/Validation response 
SUCCESS

Mar 19 2016 12:19 -- Breakpoint: 1 - Collected data from PayPal notification

Mar 19 2016 12:19 -- IPN INFO :: Transaction email details.
From IPN = paypal@[mydomain].nl | paypal@[mydomain].nl
From CONFIG = paypal@[mydomain].nl

Mar 19 2016 12:19 -- Breakpoint: 2 - Validated transaction components

Mar 19 2016 12:19 -- Breakpoint: 3 - Communication method verified

Mar 19 2016 12:19 -- IPN NOTICE :: Could not find matched txn_id record in DB. Therefore is new to us. 

Mar 19 2016 12:19 -- Breakpoint: 4 - Details:  txn_type=unique    ordersID = 0  IPN_id=0

   Relevant data from POST:
     txn_type = unique
     parent_txn_id = None
     txn_id = 3MT86572RK141461G

Mar 19 2016 12:19 -- Breakpoint: 5 - Transaction type (txn_type) = unique

ferid,
Did you ever resolve this? I am also using 138a and do not have the resources to upgrade at this time. I also received the similar message from paypal, although they obviously pushed back the implementation deadline from when you posted, it is now June 30, 2017:

*There are four remaining areas that our security upgrades will impact and we’ve identified the areas that need your attention. The chart below shows whether you’ll need to make changes, or if your business is already compliant or doesn’t use that functionality:

TLS 1.2 and HTTP/1.1 Upgrade – Complete by June 30, 2017
Update Needed: No

IPN Verification Postback to HTTPS – Complete by June 30, 2017
Update Needed: Yes

Discontinue Use of GET Method for Classic NVP/SOAP API’s – Complete by June 30, 2017
Update Needed: No

Merchant API Certificate Credentials Upgrade – Complete by January 1, 2018
Please note that this may be completed earlier based on the expiration date of your certificate
Update Needed: No*

karma-lab:

I am also using 138a

1. What version of PHP are you using? (Go to Admin->Tools->Server Info to get this)
   I'm surprised your ancient v1.3.8 is even running, since without significant patching it's absolutely incompatible with modern/supported versions of PHP.
   The "fix" is dependent on your PHP version.

karma-lab:

and do not have the resources to upgrade at this time.

2. v1.3.8 was published in 2007. If 10 years isn't enough opportunity to upgrade, what is?

1. PHP Version: 5.6.28 (Zend: 2.6.0). Is that old/obsolete? My ISP updates it every so often. Maybe the "absolutely incompatible" stuff I'm not using. :)

2. Here's the thing. I run a one-person company here. I don't have an IT department or person to hand it off to. I have a heavily customized store; it would no doubt take me a solid week to upgrade once I started, and I know it will be horrendously difficult, since I would have to figure out how to do stuff I haven't done in 10 years. Like make a copy of the store to experiment on, a copy of the mySQL database, etc. Would I like to? Yes. Do I need to? No doubt you will say yes, but so far I see no real compelling reason that I need to do it. Everything works fine. People order stuff, I process the orders, it does what it needs to do.

karma-lab:

1. PHP Version: 5.6.28 (Zend: 2.6.0). Is that old/obsolete? My ISP updates it every so often. Maybe the "absolutely incompatible" stuff I'm not using. :)Lucky you.
   I guess you must have installed at least some of the posted patches to bandage v1.3.8 to run on PHP 5.3, else you'd be getting all kinds of errors due to obsolete PHP function calls only available in older versions.
   Hopefully you've also applied the dozen-or-so critical security patches, else your site is vulnerable to hackers.
   Even then you're missing out on about a hundred other security patches and several hundred bugfixes.

karma-lab:

2. Here's the thing. I run a one-person company here. I don't have an IT department or person to hand it off to. I have a heavily customized store; it would no doubt take me a solid week to upgrade once I started, and I know it will be horrendously difficult, since I would have to figure out how to do stuff I haven't done in 10 years. Like make a copy of the store to experiment on, a copy of the mySQL database, etc. Would I like to? Yes. Do I need to? No doubt you will say yes, but so far I see no real compelling reason that I need to do it. Everything works fine. People order stuff, I process the orders, it does what it needs to do.
   Fair. I completely understand your perspective. Small companies have small budgets. Just like us here at Zen Cart.
   My perspective is this: Every day for these past 10 years I've spent trying to "keep up" on the latest changes necessary to keep peoples' stores relevant. And in so doing I make changes to the code, and publish new versions so that everyone can benefit, and try to keep those changes as simple as possible to minimize upgrade pain. When people apply the updates their stores keep running fine, and they continue making sales. And they're easy to support, because they're current.
   But when people don't apply the updates, they come back here asking me to dig back 10 years in my brain to try to remember some obscure change that was necessary way back then, or spend my time digging through old forum posts for specific instructions I've already posted a hundred times for other people, and give them the answer for free so they don't have to invest anything in their own business's tools to keep them current and contemporary. It feels like you're asking for a handout, on the back of my generosity. So it feels offensive. And people wonder why I encourage them to upgrade.

Anyway, for the solution, see post #14 earlier in this thread. Most likely you can just change $scheme = 'http://' to 'https://' instead. It's around line 399. I haven't tested it to be sure, because I don't run that old version anywhere.

karma-lab:

But for now I need to fix the PayPal issue.

Here's the thing. Do I need to (upgrade)? No doubt you will say yes, but so far I see no real compelling reason that I need to do it. Everything works fine. People order stuff, I process the orders, it does what it needs to do.

But everything is not working fine, such as the PayPal issue. Sooner rather than later you will run across another issue. And then another.

"I have a heavily customized store." All the more reason to get a a test site setup in a password protected dir. so no one and no Search Engine bots, can access it. Then you can work on it at your leisure as well as test your upgrade and changes.

Also important is to heavily document your upgrade, module installs and any other customization. You will thank yourself in the future for being able to quickly find out what you did or installed and why. And take a lot of database backups during this phase as that will save you a lot of time as well.

Website Rob:

But everything is not working fine, such as the PayPal issue.
But it will be back to working fine (for awhile) once I fix that issue. As I have done for other issues. Beats a solid week or more of work.

But I get it - upgrade, upgrade, upgrade.

Also important is to heavily document your upgrade, module installs and any other customization. I have done that for every change made. However, it's still a massive undertaking to upgrade it right now. Thanks.

DrByte:

But when people don't apply the updates, they come back here asking me to dig back 10 years in my brain to try to remember some obscure change that was necessary way back then, or spend my time digging through old forum posts for specific instructions I've already posted a hundred times for other people, and give them the answer for free so they don't have to invest anything in their own business's tools to keep them current and contemporary. It feels like you're asking for a handout, on the back of my generosity. So it feels offensive. And people wonder why I encourage them to upgrade.

With all due respect, I'd like to point out that my first post was addressed to the original poster (another user) - not you or necessarily any ZenCart employees. But I do thank you for joining the discussion.