hacking payments

Author: iliakan

.gitignore

@@ -36,4 +36,6 @@ app/stylesheets/sprites/*
 bower_components/
 
 # Passwords and other secret stuff
-config/secret.js
+modules/config/secret.js
+modules/config/certs/*
+

hmvc/payments/index.js

@@ -49,7 +49,11 @@ exports.createTransactionForm = function* (order, method) {
 
   yield transaction.persist();
 
-  return paymentModules[method].renderForm(transaction);
+  var form = yield* paymentModules[method].renderForm(transaction);
+
+  yield transaction.log('form', form);
+
+  return form;
 
 };
 

hmvc/payments/models/transaction.js

@@ -95,12 +95,22 @@ schema.methods.getStatusDescription = function() {
   throw new Error("неподдерживаемый статус транзакции");
 };
 
+schema.methods.logRequest = function*(event, request) {
+  yield this.log(event, {url: request.originalUrl, body: request.body});
+};
+
 // log anything related to the transaction
-schema.methods.log = function*(options) {
+schema.methods.log = function*(event, data) {
 
-  console.log(options);
+  if (typeof event != "string") {
+    throw new Error("event name must be a string");
+  }
 
-  options.transaction = this._id;
+  var options = {
+    transaction: this._id,
+    event: event,
+    data: data
+  };
 
   // for complex objects -> prior to logging make them simple (must be jsonable)
   // e.g for HTTP response (HTTP.IncomingMessage)

hmvc/payments/models/transactionLog.js

@@ -5,9 +5,13 @@ var schema = new Schema({
 
   transaction: {
     type: Schema.Types.ObjectId,
-    ref:  'Transaction'
+    ref:  'Transaction',
+    index: true
+  },
+  event: {
+    type: String,
+    index: true
   },
-  event: String,
   data: Schema.Types.Mixed,
 
   created:  {

hmvc/payments/payanyway/controller/callback.js

@@ -15,14 +15,16 @@ exports.post = function* (next) {
     this.throw(403, "wrong signature");
   }
 
-  yield this.transaction.log({
-    event: 'callback',
-    data:  {url: this.request.originalUrl, body: this.request.body}
-  });
+  yield this.transaction.logRequest('callback', this.request);
 
+  // signature is valid, so everything MUST be fine
   if (this.transaction.amount != parseFloat(this.request.body.MNT_AMOUNT) ||
     this.request.body.MNT_ID != config.payments.modules.payanyway.id) {
-    this.throw(404, 'transaction with given params not found');
+    yield this.transaction.persist({
+      status: Transaction.STATUS_FAIL,
+      statusMessage: "данные транзакции не совпадают с базой, свяжитесь с поддержкой"
+    });
+    this.throw(404, "transaction data doesn't match the POST body");
   }
 
   yield this.transaction.persist({

hmvc/payments/payanyway/index.js

@@ -1,7 +1,3 @@
-const jade = require('jade');
-const path = require('path');
-var config = require('config');
-var payment = require('payment');
 
 var router = require('./router');
 

hmvc/payments/payanyway/renderForm.js

@@ -2,11 +2,12 @@ const jade = require('jade');
 const config = require('config');
 const path = require('path');
 
-module.exports = function (transaction) {
+module.exports = function* (transaction) {
 
   return jade.renderFile(path.join(__dirname, 'templates/form.jade'), {
     amount: transaction.amount,
     number: transaction.number,
+    currency: config.payments.currency,
     id:     config.payments.modules.payanyway.id
   });
 

hmvc/payments/payanyway/router.js

@@ -1,5 +1,4 @@
 var Router = require('koa-router');
-var payment = require('payment');
 
 var router = module.exports = new Router();
 
@@ -9,11 +8,10 @@ var success = require('./controller/success');
 var inprogress = require('./controller/inprogress');
 var cancel = require('./controller/cancel');
 
-// webmoney server posts here (in background)
 router.post('/callback', callback.post);
 
-// webmoney server redirects here if payment successful
 router.get('/success', success.get);
+router.get('/inprogress', inprogress.get);
 
 router.get('/cancel', cancel.get);
 

hmvc/payments/payanyway/templates/form.jade

@@ -2,7 +2,7 @@
 form(method="POST" action="https://www.moneta.ru/assistant.htm" accept-charset="UTF-8")
   input(type="hidden",name="MNT_ID",value=id)
   input(type="hidden",name="MNT_TRANSACTION_ID",value=number)
-  input(type="hidden",name="MNT_CURRENCY_CODE",value="RUB")
+  input(type="hidden",name="MNT_CURRENCY_CODE",value=currency)
   input(type="hidden",name="MNT_AMOUNT",value=amount)
   input(type="hidden",name="paymentSystem.limitIds",value="843858,248362,822360,545234,1028,499669")
   input(type="submit",value="Оплатить")

hmvc/payments/paypal/controller/callback.js

@@ -0,0 +1,84 @@
+const config = require('config')
+const paypalConfig = config.payments.modules.paypal;
+const Order = require('../../models/order');
+const Transaction = require('../../models/transaction');
+const TransactionLog = require('../../models/transactionLog');
+const log = require('js-log')();
+const request = require('koa-request');
+
+// docs:
+//
+// https://developer.paypal.com/webapps/developer/docs/classic/ipn/integration-guide/IPNIntro/
+
+log.debugOn();
+
+/* jshint -W106 */
+exports.post = function* (next) {
+
+  yield* this.loadTransaction('invoice', {skipOwnerCheck: true});
+
+  yield this.transaction.logRequest('ipn-unverified', this.request);
+
+  var qs = {
+    'cmd': '_notify-validate'
+  };
+
+  for (var field in this.request.body) {
+    qs[field] = this.request.body[field];
+  }
+
+  // request oauth token
+  var options = {
+    method: 'GET',
+    qs:     qs,
+    url:    'https://www.paypal.com/cgi-bin/webscr'
+  };
+
+
+  yield this.transaction.log('request ipn verify', options);
+
+  var response;
+  try {
+    response = yield request(options);
+  } catch(e) {
+    yield this.transaction.log('request ipn verify failed', e.message);
+    this.throw(403, "Couldn't verify ipn");
+  }
+
+  if (response.body != "VERIFIED") {
+    this.throw(403, "Invalid IPN");
+  }
+
+  // ipn is verified now! But we check if it's data matches the transaction (as recommended in docs)
+  if (this.transaction.amount != parseFloat(this.request.body.mc_gross) ||
+    this.request.body.receiver_email != paypalConfig.email ||
+    this.request.body.mc_currency != config.payments.currency) {
+
+    yield this.transaction.persist({
+      status:        Transaction.STATUS_FAIL,
+      statusMessage: "данные транзакции не совпадают с базой, свяжитесь с поддержкой"
+    });
+    this.throw(404, "transaction data doesn't match the POST body");
+  }
+
+  // match agains latest ipn in logs as recommended:
+  // if there was an IPN about the same transaction, and it's state is the same
+  //   => then the current one is a duplicate
+
+  var previousIpn = yield TransactionLog.findOne({
+    event: "ipn",
+    transaction: this.transaction._id
+  }).sort({created: -1}).exec();
+
+  if (previousIpn && previousIpn.data.payment_status == this.request.body.payment_status) {
+    yield this.transaction.logRequest("ipn duplicate", this.request);
+    // ignore duplicate
+    this.body = '';
+    return;
+  }
+
+  // now we have a valid non-duplicate IPN, let's update the transaction
+
+
+  this.body = '';
+};