Fixes

bountyx's picture
Offline
Joined: 03/17/2009
Juice: 12
Fixes

Hey there,

The servers in the module are expired, that's why it probably wasn't working for you. Paypal purchased versign and no longer uses the versign.com domain to authenticate their payflow requests. The new servers are payflowpro.paypal.com (for live site) and pilot-payflowpro.paypal.com.

In addition to these changes, I made some security enhancments to prevent MTM attacks. Turning off VERIFYPEER in cURL is not the best option. Since not everyone has access to curl's installed cacert.pem file for their root athority, I bundled the one used by mozilla which includes all the biggest CA names. In the payflow gateway settings, you can point the relative directory to the bundled cacert.pem file.

Please see the readme for more information. Attached is the module, instructions, changes, and cacert.pem for proper peer validation.

If you already have the original payflow pro module from above installed, you need to remove it from your drupal installation, and install this version instead. My attached file is the entire module bundled with fixes.

AttachmentSize
payflowpro_fixes_03-17-2009.zip 125.11 KB
Payflow Pro Full Integration (Including recurring profiles) By: Souvent22@drupal.org (11 replies) Mon, 10/22/2007 - 12:24