spree_paypal_website_standard 0.8.2 → 0.8.3

data/README.md

@@ -34,7 +34,7 @@ You may want to implement your own custom logic by adding 'state_machine' hooks.
 
 Add to your Spree application Gemfile.
 
-    gem "pp_website_standard", :git => "git://github.com/tomash/spree-pp-website-standard.git"
+    gem "spree_paypal_website_standard", :git => "git://github.com/tomash/spree-pp-website-standard.git"
 
 Run the install rake task to copiy migrations (create payment_notifications table)
 
@@ -60,10 +60,29 @@ The following configuration options (keys) can be set:
     :currency_code   # default EUR
     :sandbox_url     # paypal url in sandbox mode, default https://www.sandbox.paypal.com/cgi-bin/webscr
     :paypal_url      # paypal url in production, default https://www.paypal.com/cgi-bin/webscr
-    :populate_address (true/false) # pre-populate fields of billing address based on spree order data
+    :populate_address # (true/false) pre-populate fields of billing address based on spree order data
+    :encryption      # (true/false) use encrypted shopping cart
+    :cert_id         # id of certificate used to encrypted stuff
+    :ipn_secret      # secret string for authorizing IPN
 
-Only the first three ones need to be set up in order to get running.
+Only the first three ones need to be set up in order to get running. 
 
+The last three are required for secure, encrypted operation (see below).
+
+## Encryption / Security
+
+The payment link can be encrypted using an SSL key pair and a PayPal public key. In order to attempt this encryption, the following elements must be available. If these are not available a normal link will be generated.
+
+Spree::Paypal::Config[:encrypted] must be set to true.
+Spree::Paypal::Config[:cert_id] must be set to a valid certificate id.
+Spree::Paypal::Config[:ipn_secret] must be set to a string considered secret.
+Application must have a Rails.root/certs directory with following files:
+
+    app_cert.pem # application certificate
+    app_key.pem  # application key
+    paypal_cert_#{Rails.env}.pem # paypal certificate
+
+The best instructions on what is what, how these files should be generated etc. are [in AsciiCast 143](http://asciicasts.com/episodes/143-paypal-security) (basically the code of this extension is also based on this AsciiCast). 
 
 ## IPN Notes (outdated!)
 

data/app/controllers/payment_notifications_controller.rb

@@ -2,12 +2,18 @@ class PaymentNotificationsController < ApplicationController
   protect_from_forgery :except => [:create]
   skip_before_filter :restriction_access  
   
-  def create  
+  def create
+    if(Spree::Paypal::Config[:encryption] && (params[:secret] != Spree::Paypal::Config[:ipn_secret]))
+      logger.info "PayPal_Website_Standard: attempt to send an IPN with invalid secret"
+      raise Exception
+    end
+    
     @order = Order.find_by_number(params[:invoice])
     PaymentNotification.create!(:params => params, 
       :order_id => @order.id,
       :status => params[:payment_status], 
       :transaction_id => params[:txn_id])
+    logger.info "PayPal_Website_Standard: processing payment notification for invoice #{params["invoice"]}, amount is #{params["mc_gross"]} #{params["mc_currency"]}"
     
     # this logging stuff won't live here for long...
 
@@ -17,21 +23,29 @@ class PaymentNotificationsController < ApplicationController
 
       #create payment for this order
       payment = Payment.new
-      payment.amount = order.total
+      
+      # 1. Assume that if payment notification comes, it's exactly for the amount
+      # sent to paypal (safe assumption -- cart can't be edited while on paypal)
+      # 2. Can't use Order#total, as it's intercepted by spree-multi-currency
+      # which might lead to lots of false "credit owed" payment states
+      # (when they should be "complete")
+      payment.amount = order.read_attribute(:total)
+      logger.info "PayPal_Website_Standard: set payment.amount to #{payment.amount} based on order's total #{order.read_attribute(:total)}"
+      
       payment.payment_method = Order.paypal_payment_method
       order.payments << payment
       payment.started_processing
 
       order.payment.complete
-      logger.info("order #{order.number} (#{order.id}) -- completed payment")
+      logger.info("PayPal_Website_Standard: order #{order.number} (#{order.id}) -- completed payment")
       while order.state != "complete"
          order.next
-         logger.info("advanced state of Order #{order.number} (#{order.id}). current state #{order.state}. thread #{Thread.current.to_s}. issuing callback")
+         logger.info("PayPal_Website_Standard: advanced state of Order #{order.number} (#{order.id}). current state #{order.state}. thread #{Thread.current.to_s}. issuing callback")
          state_callback(:after) # that line will run all _not run before_ callbacks
       end
       order.update_totals
       order.update!
-      logger.info("Order #{order.number} (#{order.id}) updated successfully, IPN complete")
+      logger.info("PayPal_Website_Standard: Order #{order.number} (#{order.id}) updated successfully, IPN complete")
     end
     
     render :nothing => true

data/app/models/order_decorator.rb

@@ -1,6 +1,11 @@
 Order.class_eval do
   has_many :payment_notifications
   
+  # SSL certificates for encrypting paypal link
+  PAYPAL_CERT_PEM = "#{Rails.root}/certs/paypal_cert_#{Rails.env}.pem"  
+  APP_CERT_PEM = "#{Rails.root}/certs/app_cert.pem"  
+  APP_KEY_PEM = "#{Rails.root}/certs/app_key.pem"  
+ 
   def shipment_cost
     adjustment_total - credit_total
   end
@@ -12,4 +17,50 @@ Order.class_eval do
   def self.paypal_payment_method
     PaymentMethod.select{ |pm| pm.name.downcase =~ /paypal/}.first
   end
+
+  def self.use_encrypted_paypal_link?
+    Spree::Paypal::Config[:encryption] &&
+    Spree::Paypal::Config[:ipn_secret] &&
+    Spree::Paypal::Config[:cert_id] &&
+    File.exist?(PAYPAL_CERT_PEM) &&   
+    File.exist?(APP_CERT_PEM) &&   
+    File.exist?(APP_KEY_PEM)   
+  end
+  
+  def paypal_encrypted(payment_notifications_url, options = {})
+    values = {
+      :business => Spree::Paypal::Config[:account],
+      :invoice => self.number,
+      :cmd => '_cart',
+      :upload => 1,
+      :currency_code => options[:currency_code] || Spree::Paypal::Config[:currency_code],
+      :handling_cart => self.ship_total,
+      :return => Spree::Paypal::Config[:success_url],
+      :notify_url => payment_notifications_url,
+      :charset => "utf-8",
+      :cert_id => Spree::Paypal::Config[:cert_id],
+      :page_style => Spree::Paypal::Config[:page_style],
+      :tax_cart => self.tax_total
+    }  
+      
+    self.line_items.each_with_index do |item, index|  
+      values.merge!({  
+        "amount_#{index + 1}" => item.price,  
+        "item_name_#{index + 1}" => item.variant.product.name,  
+        "item_number_#{index + 1}" => item.variant.product.id,  
+        "quantity_#{index + 1}" => item.quantity  
+      })  
+    end 
+
+    encrypt_for_paypal(values)  
+  end
+  
+  def encrypt_for_paypal(values)  
+    paypal_cert = File.read(PAYPAL_CERT_PEM)
+    app_cert = File.read(APP_CERT_PEM)
+    app_key = File.read(APP_KEY_PEM)
+    signed = OpenSSL::PKCS7::sign(OpenSSL::X509::Certificate.new(app_cert), OpenSSL::PKey::RSA.new(app_key, ''), values.map { |k, v| "#{k}=#{v}" }.join("\n"), [], OpenSSL::PKCS7::BINARY)  
+    OpenSSL::PKCS7::encrypt([OpenSSL::X509::Certificate.new(paypal_cert)], signed.to_der, OpenSSL::Cipher::Cipher::new("DES3"), OpenSSL::PKCS7::BINARY).to_s.gsub("\n", "")  
+  end
+
 end

data/app/views/checkout/_paypal_checkout.html.erb

@@ -6,44 +6,51 @@
 %>
 <%= form_tag submit_url do %> 
 
-  <input id="business" name="business" type="hidden" value="<%= Spree::Paypal::Config[:account] %>" />
-  <input id="invoice" name="invoice" type="hidden" value="<%= @order.number %>" />
+  <%- if(Order.use_encrypted_paypal_link?) %>
+    <%= hidden_field_tag(:cmd, "_s-xclick") %>
+    <%= hidden_field_tag(:encrypted, @order.paypal_encrypted(payment_notifications_url(:secret => Spree::Paypal::Config[:ipn_secret]))) %>
+  <% else %>
   
-  <% @order.line_items.each_with_index do |item, index| %>
-    <%- if item.variant.respond_to?(:paypal_name) %>
-      <input id="item_name_<%= index + 1 %>" name="item_name_<%= index + 1 %>" type="hidden" value="<%=  item.variant.paypal_name  %>"  />
-    <% else %>
-      <input id="item_name_<%= index + 1 %>" name="item_name_<%= index + 1 %>" type="hidden" value="<%= item.variant.product.name %>" />
+    <input id="page_style" name="page_style" type="hidden" value="<%= Spree::Paypal::Config[:page_style] %>"/>
+    <input id="business" name="business" type="hidden" value="<%= Spree::Paypal::Config[:account] %>" />
+    <input id="invoice" name="invoice" type="hidden" value="<%= @order.number %>" />
+    
+    <% @order.line_items.each_with_index do |item, index| %>
+      <%- if item.variant.respond_to?(:paypal_name) %>
+        <input id="item_name_<%= index + 1 %>" name="item_name_<%= index + 1 %>" type="hidden" value="<%=  item.variant.paypal_name  %>"  />
+      <% else %>
+        <input id="item_name_<%= index + 1 %>" name="item_name_<%= index + 1 %>" type="hidden" value="<%= item.variant.product.name %>" />
+      <% end %>
+      <input id="amount_<%= index + 1 %>" name="amount_<%= index + 1 %>" type="hidden" value="<%= item.price %>" />
+      <input id="quantity_<%= index + 1 %>" name="quantity_<%= index + 1 %>" type="hidden" value="<%= item.quantity %>" />
+    <% end %>
+    
+    <input id="currency_code" name="currency_code" type="hidden" value="<%= Spree::Paypal::Config[:currency_code] %>" />
+    <input id="handling_cart" name="handling_cart" type="hidden" value="<%= @order.ship_total %>" /> 
+    <input id="tax_cart"      name="tax_cart"      type="hidden" value="<%= @order.tax_total %>" />
+    
+    
+    <input id="cmd" name="cmd" type="hidden" value="_cart" />
+    <input type="hidden" name="upload" value="1" />
+    <input id="notify_url" name="notify_url" type="hidden" value="<%= payment_notifications_url %>" />
+    <input type="hidden" name="rm" value ="2" />
+    <input id="return" name="return" type="hidden" value="<%= Spree::Paypal::Config[:success_url] %>" />
+    
+    <input id="charset" name="charset" type="hidden" value="utf-8" />
+    
+    <% if(Spree::Paypal::Config[:populate_address] && @order.bill_address) %>
+      <input type="hidden"  name="address1"    id="address1" value="<%= @order.bill_address.address1 %>" />
+      <input type="hidden"  name="address2"    id="address2" value="<%= @order.bill_address.address2 %>" />
+      <input type="hidden"  name="city"        id="city"     value="<%= @order.bill_address.city %>"     />
+      <input type="hidden"  name="country"     id="country"  value="<%= @order.bill_address.country.iso %>" />
+      <input type="hidden"  name="email"       id="email"    value="<%= @order.email %>"                 />
+      <input type="hidden"  name="first_name"  id="first_name" value="<%= @order.bill_address.firstname %>" />
+      <input type="hidden"  name="last_name"   id="last_name"  value="<%= @order.bill_address.lastname %>"  />
+      <input type="hidden"  name="zip"         id="zip"      value="<%= @order.bill_address.zipcode %>"     />
+      <input type="hidden"  name="night_phone_b"         id="night_phone_b"      value="<%= @order.bill_address.phone %>"     />
     <% end %>
-    <input id="amount_<%= index + 1 %>" name="amount_<%= index + 1 %>" type="hidden" value="<%= item.price %>" />
-    <input id="quantity_<%= index + 1 %>" name="quantity_<%= index + 1 %>" type="hidden" value="<%= item.quantity %>" />
   <% end %>
   
-  <input id="currency_code" name="currency_code" type="hidden" value="<%= Spree::Paypal::Config[:currency_code] %>" />
-  <input id="handling_cart" name="handling_cart" type="hidden" value="<%= @order.ship_total %>" /> 
-  <input id="tax_cart"      name="tax_cart"      type="hidden" value="<%= @order.tax_total %>" />
-  
-  
-  <input id="cmd" name="cmd" type="hidden" value="_cart" />
-  <input type="hidden" name="upload" value="1" />
-  <input id="notify_url" name="notify_url" type="hidden" value="<%= payment_notifications_url %>" />
-  <input type="hidden" name="rm" value ="2" />
-  <input id="return" name="return" type="hidden" value="<%= Spree::Paypal::Config[:success_url] %>" />
-  
-  <input id="charset" name="charset" type="hidden" value="utf-8" />
-  
-  <% if(Spree::Paypal::Config[:populate_address] && @order.bill_address) %>
-    <input type="hidden"  name="address1"    id="address1" value="<%= @order.bill_address.address1 %>" />
-    <input type="hidden"  name="address2"    id="address2" value="<%= @order.bill_address.address2 %>" />
-    <input type="hidden"  name="city"        id="city"     value="<%= @order.bill_address.city %>"     />
-    <input type="hidden"  name="country"     id="country"  value="<%= @order.bill_address.country.iso %>" />
-    <input type="hidden"  name="email"       id="email"    value="<%= @order.email %>"                 />
-    <input type="hidden"  name="first_name"  id="first_name" value="<%= @order.bill_address.firstname %>" />
-    <input type="hidden"  name="last_name"   id="last_name"  value="<%= @order.bill_address.lastname %>"  />
-    <input type="hidden"  name="zip"         id="zip"      value="<%= @order.bill_address.zipcode %>"     />
-    <input type="hidden"  name="night_phone_b"         id="night_phone_b"      value="<%= @order.bill_address.phone %>"     />
-  <% end %>
-
   <%= image_submit_tag "pp_checkout.gif" %>
 
 <% end -%>

data/lib/paypal_configuration.rb

@@ -10,7 +10,13 @@ class PaypalConfiguration < Configuration
   
   # this stuff is really handy
   preference :currency_code, :string, :default => "EUR"
+  preference :page_style, :string, :default => 'PayPal'
   
+  # encryption / security
+  preference :encrypted, :boolean, :default => false
+  preference :cert_id, :string, :default => "12345678"
+  preference :ipn_secret, :string, :default => "secret"
+
   validates_presence_of :name
   validates_uniqueness_of :name
-end
+end

data/lib/{pp_website_standard.rb → spree_paypal_website_standard.rb}

@@ -1,7 +1,7 @@
 require 'spree_core'
-require 'pp_website_standard_hooks'
+require 'spree_paypal_website_standard_hooks'
 
-module PpWebsiteStandard
+module SpreePaypalWebsiteStandard
   class Engine < Rails::Engine
 
     config.autoload_paths += %W(#{config.root}/lib)

data/lib/{pp_website_standard_hooks.rb → spree_paypal_website_standard_hooks.rb}

@@ -1,4 +1,4 @@
-class PpWebsiteStandardHooks < Spree::ThemeSupport::HookListener
+class SpreePaypalWebsiteStandardHooks < Spree::ThemeSupport::HookListener
   # custom hooks go here
   # insert_before :checkout_summary_box, 'checkout/paypal_checkout'
 end

metadata

@@ -1,13 +1,12 @@
 --- !ruby/object:Gem::Specification 
 name: spree_paypal_website_standard
 version: !ruby/object:Gem::Version 
-  hash: 59
   prerelease: false
   segments: 
   - 0
   - 8
-  - 2
-  version: 0.8.2
+  - 3
+  version: 0.8.3
 platform: ruby
 authors: 
 - Gregg Pollack, Sean Schofield, Tomasz Stachewicz
@@ -15,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-04-29 00:00:00 +02:00
+date: 2011-10-10 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -26,16 +25,15 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 103
         segments: 
         - 0
-        - 30
+        - 50
         - 0
-        version: 0.30.0
+        version: 0.50.0
   type: :runtime
   version_requirements: *id001
-description: 
-email: 
+description: Spree extension for integration with PayPal Website Standard payment
+email: tomekrs@o2.pl
 executables: []
 
 extensions: []
@@ -46,9 +44,9 @@ files:
 - README.md
 - LICENSE
 - lib/spree/paypal/config.rb
-- lib/pp_website_standard.rb
+- lib/spree_paypal_website_standard.rb
 - lib/paypal_configuration.rb
-- lib/pp_website_standard_hooks.rb
+- lib/spree_paypal_website_standard_hooks.rb
 - lib/tasks/pp_website_standard.rake
 - lib/tasks/install.rake
 - app/controllers/checkout_controller_decorator.rb
@@ -74,7 +72,6 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 57
       segments: 
       - 1
       - 8
@@ -85,7 +82,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"