payr 1.0.4 → 1.0.5

data/README.md

@@ -137,6 +137,9 @@ The controller could look something like this for example :
 	end
 ```
 
+
+
+
 Basically, thoses actions do :
 ```ruby
 #
@@ -178,6 +181,38 @@ payr_bills_pay_path(article_id: pack.id,
 ```
 This will call the bills#action and then redirect the user to the paybox paiement page.
 
+# /!\ There is a security flaw in the above lines
+
+While I'm correcting it, you MUST override the pay action, otherwise, someone could just make a get with the wanted amount and the wanted article.
+
+a possible overriding would be this:
+
+```ruby
+class Paiement::CallbacksController < Payr::BillsController
+	before_filter :authenticate_user!, except: [:ipn]
+	def pay
+	 	article = Pack.find params[:article_id]
+    @bill = Payr::Bill.new(buyer_id: current_user.id,
+                           amount: article.price,
+                           article_id: params[:article_id],
+                           state: Payr::Bill::UNPROCESSED,
+                           bill_reference: params[:bill_reference])
+    @payr = Payr::Client.new
+    if @bill.save
+      @paybox_params = @payr.get_paybox_params_from command_id: @bill.id, 
+                                                    buyer_email: current_recruiter.email,
+                                                    total_price: article.price,
+                                                    callbacks:  { 
+                                                                  paid: payr_bills_paid_url, 
+                                                                  refused: payr_bills_refused_url,   
+                                                                  cancelled: payr_bills_cancelled_url,
+                                                                  ipn: payr_bills_ipn_url
+																																}
+	end                                                               
+end
+```
+
+
 You can also override the views by creating the appropriate files :
 ```sh
 $ > ls app/views/paiement/callbacks

data/lib/payr/client.rb

@@ -32,6 +32,7 @@ module Payr
       returned_hash.merge!(pbx_typepaiement: Payr.typepaiement, 
                            pbx_typepcarte: Payr.typecard) unless Payr.typepaiement.nil? || Payr.typecard.nil?
 
+      returned_hash.merge! params[:options] unless params[:options].blank?
 			base_params = self.to_base_params(returned_hash)			
 
 			returned_hash.merge(pbx_hmac: self.generate_hmac(base_params))

data/lib/payr/version.rb

@@ -1,3 +1,3 @@
 module Payr
-  VERSION = "1.0.4"
+  VERSION = "1.0.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: payr
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.5
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-26 00:00:00.000000000 Z
+date: 2013-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -138,7 +138,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -296478619546749009
+      hash: -3487819084611514497
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -147,7 +147,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -296478619546749009
+      hash: -3487819084611514497
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.24