switching PayPal IPN Verification Postback to HTTPS

Hi,

This issue has brought up recently for v138a, but there appears to be a confusion in that thread and perhaps low interest because of the old zencart version.

I am running v151, but I have looked at the code and it is the same in v154.

First, this is not about paypal talking to zencart as suggested in post 10, it is about zencart talking to paypal as described in the diagram provided by paypal:

I believe the relevant code is in function ipn_postback($mode = 'IPN', $pdtTX = '') which is located in includes/modules/payment/paypal/paypal_functions.php

The following code is the same in v154 and it hardcodes the protocol to non-secure http:// (in the first line with red markup)

    // send received data back to PayPal for validation
    $scheme = 'http://';
    //Parse url
    $web = parse_url($scheme . (defined('MODULE_PAYMENT_PAYPAL_HANDLER') ? MODULE_PAYMENT_PAYPAL_HANDLER : 'www.paypal.com/cgi-bin/webscr'));
    if (isset($_POST['test_ipn']) && $_POST['test_ipn'] == 1) {
      $web = parse_url($scheme . 'www.sandbox.paypal.com/cgi-bin/webscr');
    }
    //Set the port number
    if($web['scheme'] == "https") {
      $web['port']="443";  $ssl = "ssl://";
    } else {
      $web['port']="80";   $ssl = "";
    }

The if statement marked up in blue always falls back to else clause in the second red mark up (the purple is never executed), so I am not sure why it is there, except that somebody thought about probing for secure connection after the initial assignment of scheme but then didn't finish it up.

So, what would be the appropriate course of action?
Simply hardcode the scheme to https:// and possibly MODULE_PAYMENT_PAYPAL_HANDLER, or is there already a function that probes for https:// that we can use to test and switch one way or the other?

Checking the similar threads at the bottom of this post
https://www.zen-cart.com/showthread.php?219666-PayPal-IPN-Verification-Postback-to-HTTPS

kobra:

Checking the similar threads at the bottom of this post
https://www.zen-cart.com/showthread.php?219666-PayPal-IPN-Verification-Postback-to-HTTPS

As I noted above this is precisely the reason I started this thread - the one you're referencing doesn't address the problem (the post #10 from that thread I referenced in the OP even misdirects it).

Your suggestion in that thread is 'upgrade because the v138a code is very old', but as I explained above the v151 I am using is
(a) relatively recent (b) the relevant function ipn_postback() is exactly the same in the latest v154.

Can you, please, point me to the difference in the v154 code compared to v151 which would justify your proposed upgrade providing a solution to this specific issue?

Where is the code that you reference above? I found something similar in includes/extras/ipncheck.php, but it uses https: not http:... And can't seem to find the area to which you seem to be referriing in 1.5.1 nor 1.5.4.maybe by directly referencing the code section, that would help. Otherwise, so far review of the various paypal files hasn't exposed what you reference above.

Okay, after re-reading the earlier post a few times, found the file to be includes/modules/payment/paypal/paypal_functions.php. Looking at version 1.5.5 of ZC, it looks like that $web related. Assignment has been changed to https:// from the above referenced http://... So, when made an official version, it looks like the function ipn_check will usehttps, though it seems like other calls to paypal related sites seem to use https all of the time.

Many thanks. Yeah, looks like 1.5.5. has simply hardcoded https instead of http

https://github.com/zencart/zencart/blob/v155/includes/modules/payment/paypal/paypal_functions.php

Since this is the solution in the current development I'll make the same change.

moogawooga:

Many thanks. Yeah, looks like 1.5.5. has simply hardcoded https instead of http

https://github.com/zencart/zencart/blob/v155/includes/modules/payment/paypal/paypal_functions.php

Since this is the solution in the current development I'll make the same change.

At the same time it is highly advised to upgrade to the latest, even though ZC 1.5.5 is just around the corner, the last several versions have been necessitated not really because the cart software needed new things, but because the software on which it depends (PHP) has been revised and the ZC code had to follow suit... Here is a situation where a payment processor is expecting different communication protocols and thus some other change is needed but at least it is/will be captured in the latest version of ZC with likely many threads to follow when so enabled.

Anyways, all that to say, really should upgrade. :P

I definitely will; I've been patching the more important things along the way but have been delaying the upgrade because it's a relatively big job (the people who did the store theme were hacks and overwrote files that shouldn't be modified).

The thing was that the ipn postback issue that paypal is complaining about is not fixed in the current release 1.5.4, so even if I'd upgraded to that it doesn't solve it.

The thing was that the ipn postback issue that paypal is complaining about is not fixed in the current release 1.5.4
I have no problem with paypal using the 1.5.4 version of code

kobra:

I have no problem with paypal using the 1.5.4 version of code

And the OP hasn't reported a problem with using PayPal with ZC 1.5.1 either, but the issue is not about the now, but about what is to come based on the information provided by PayPal to the OP and that ZC 1.5.5 contains changes compared to ZC 1.5.4 that appear to address the topic of discussion/area of identified code.

kobra:

I have no problem with paypal using the 1.5.4 version of code
Indeed, at present there is no functional issue, and there wouldn't be one at least until 9/30/2016, irrespective of the zen-cart version (even 1.3.8 probably works fine).

I assume that either 1.5.5 will be released by then or there will be a patch to 1.5.4 that makes the above mentioned change. I just didn't want to wait until then (the store owners feel better if they doesn't see outstanding issues in the emails paypal sends them), but you certainly could.

moogawooga:

Indeed, at present there is no functional issue, and there wouldn't be one at least until 9/30/2016, irrespective of the zen-cart version (even 1.3.8 probably works fine).

I assume that either 1.5.5 will be released by then or there will be a patch to 1.5.4 that makes the above mentioned change. I just didn't want to wait until then (the store owners feel better if they doesn't see outstanding issues in the emails paypal sends them), but you certainly could.

Fwiw, recent post by ZC core team member is that basically provided nothing significant comes up in the very near future, ZC 1.5.5 is expected to be released by next Wednesday.

Has this been addressed? I got this from PayPal:

Reminder: REQUIRED to avoid service interruptions you need to complete important security upgrades.

Every day, hundreds of millions of people use PayPal to manage and move money online or on a mobile device. That’s why one of our top priorities is to ensure our customers have a safe, secure experience when transacting with PayPal.

This year, we’ve made a number of upgrades to the PayPal system enabling us to continue providing the highest level of security available for customers. Throughout 2018, we will continue to upgrade our security protocols to the highest levels of protection available, which includes moving all of our systems to TLS 1.2, an enhanced security protocol that encrypts customer data over the Internet. We also announced several new security requirements for merchants who use PayPal, to ensure they do their part to protect sensitive customer data, as well.

Our records indicate that you still need to make critical security upgrades to your systems. If you see a “YES” next to a security change, your integration must be updated to accept these new security measures as soon as possible.

Change Change Required?
Merchant API Certificate Credential Upgrade No
TLS 1.2 and HTTP/1.1 Upgrade No
IPN Verification Postback to HTTPS Yes
Discontinue Use of GET Method of Classic NVP/SOAP No
I Googled the highlighted term and got this page. I'm using 1.5.4. They appear to be giving a deadline of June 2018.

s_mack:

Has this been addressed?

I'm using 1.5.4.

Ya, it was addressed in December 2015 as part of the v1.5.5 release preparation:
https://github.com/zencart/zencart/commit/80c4eaa89b6c9ab2033f317ac914170435e1580a#diff-59c9128b85b89a779f069a145c8844ca

Thanks.