danielneis / moodle-enrol_pagseguro

process.php

<?php

For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 38 and the first side effect is on line 33.

// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

/**
 * Listens for Instant Payment Notification from pagseguro
 *
 * This script waits for Payment notification from pagseguro,
 * then double checks that data by sending it back to pagseguro.
 * If pagseguro verifies this then it sets up the enrolment for that
 * user.
 *
 * @package    enrol
 * @subpackage pagseguro
 * @copyright 2010 Eugene Venter
 * @author     Eugene Venter - based on code by others
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

//header("access-control-allow-origin: https://ws.pagseguro.uol.com.br");
require('../../config.php');
require_once("lib.php");
require_once($CFG->libdir.'/eventslib.php');
require_once($CFG->libdir.'/enrollib.php');

define('COMMERCE_PAGSEGURO_STATUS_AWAITING', 1);
define('COMMERCE_PAGSEGURO_STATUS_IN_ANALYSIS', 2);
define('COMMERCE_PAGSEGURO_STATUS_PAID', 3);
define('COMMERCE_PAGSEGURO_STATUS_AVAILABLE', 4);
define('COMMERCE_PAGSEGURO_STATUS_DISPUTED', 5);
define('COMMERCE_PAGSEGURO_STATUS_REFUNDED', 6);
define('COMMERCE_PAGSEGURO_STATUS_CANCELED', 7);
define('COMMERCE_PAYMENT_STATUS_SUCCESS', 'success');
define('COMMERCE_PAYMENT_STATUS_FAILURE', 'failure') ;
define('COMMERCE_PAYMENT_STATUS_PENDING', 'pending');

$userid = $USER->id;
$plugin = enrol_get_plugin('pagseguro');
$email = $plugin->get_config('pagsegurobusiness');
$token = $plugin->get_config('pagsegurotoken');

$error_returnurl   = $CFG->wwwroot.'/enrol/pagseguro/return.php';
$success_returnurl = $CFG->wwwroot.'/enrol/pagseguro/return.php';

$instanceid  = optional_param('instanceid', 0, PARAM_INT);

$plugin_instance = $DB->get_record("enrol", array("id" => $instanceid, "status" => 0));
$courseid     = $plugin_instance->courseid;
$course       = $DB->get_record('course', array('id' => $courseid));
$currency     = $plugin->get_config('currency');
$encoding     = 'UTF-8';
$item_id      = $courseid;
$item_desc    = empty($course->fullname) ? null : $course->fullname;
$item_qty     = (int)1;
$item_cost    = empty($plugin_instance->cost) ? 0.00 : number_format($plugin_instance->cost, 2);
$item_cost    = str_replace(',', '', $item_cost);
$item_amount  = $item_cost;

$redirect_url = $CFG->wwwroot.'/enrol/pagseguro/process.php?instanceid='.$instanceid;
$submitValue  = get_string("sendpaymentbutton", "enrol_pagseguro");

$submited = optional_param('submitbutton', '', PARAM_RAW);

$notificationType = optional_param('notificationType', '', PARAM_RAW);
$notificationCode = optional_param('notificationCode', '', PARAM_RAW);

$transactionid = optional_param('transaction_id', '', PARAM_RAW);

if ($submited) {
    $url = "https://ws.pagseguro.uol.com.br/v2/checkout/?email=" . urlencode($email) . "&token=" . $token;

    $xml = "<?xml version=\"1.0\" encoding=\"$encoding\" standalone=\"yes\"?>
        <checkout>
            <currency>$currency</currency>
            <redirectURL>$redirect_url</redirectURL>
            <items>
                <item>
                    <id>$item_id</id>
                    <description>$item_desc</description>
                    <amount>$item_amount</amount>
                    <quantity>$item_qty</quantity>
                </item>
            </items>
        </checkout>";

    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_HTTPHEADER, Array("Content-Type: application/xml; charset=UTF-8"));
    curl_setopt($curl, CURLOPT_POSTFIELDS, trim($xml));
    $xml = curl_exec($curl);

    curl_close($curl);

    if ($xml == 'Unauthorized') {
        // Error=1 Não autorizado.
        $error_returnurl .= "?id={$courseid}&error=1";
        header("Location: $error_returnurl");
        exit;
    }

    $xml = simplexml_load_string($xml);

    if (count($xml->error) > 0) {
        $error_returnurl .= "?id={$courseid}&error=2";
        header("Location: $error_returnurl");
        exit;
    }

    header('Location: https://pagseguro.uol.com.br/v2/checkout/payment.html?code='.$xml->code);
}

// Here the user was redirected back from PagSeguro with transaction_id informed on GET.
if ($transactionid) {
    $url = "https://ws.pagseguro.uol.com.br/v2/transactions/{$transactionid}?email={$email}&token={$token}";

    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    $transaction = curl_exec($curl);
    curl_close($curl);

    if ($transaction == 'Unauthorized'){

This code seems to be duplicated across your project.

        // Error=1 Não autorizado.
        $error_returnurl .= "?id={$courseid}&error=1";
        header("Location: $error_returnurl");
        exit;//Mantenha essa linha
    } else {
        $transaction_data  = serialize(trim($transaction));
        process_moodle($transaction_data, $instanceid, $courseid);
    }

}

// Here is old notification system the return from PagSeguro.
if (!empty($notificationCode)) {
    $transaction = null;
    // Sets the web service URL.
    $url = "https://ws.pagseguro.uol.com.br/v2/transactions/notifications/" . $notificationCode . "?email=".$email."&token=".$token;

    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    $transaction = curl_exec($curl);
    curl_close($curl);

    if ($transaction == 'Unauthorized'){

This code seems to be duplicated across your project.

        // Error=1 Não autorizado.
        $error_returnurl .= "?id={$courseid}&error=1";
        header("Location: $error_returnurl");
        exit;//Mantenha essa linha
    } else {
        $transaction_data  = serialize(trim($transaction));
        process_moodle($transaction_data, $instanceid, $courseid);
    }
}

function process_moodle($transaction_data, $instanceid, $cid) {
    global $CFG,$USER,$DB,$course;

Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

    /// Read all the data from pagseguro and get it ready for later;
    /// we expect only valid UTF-8 encoding, it is the responsibility
    /// of user to set it up properly in pagseguro business account,
    /// it is documented in docs wiki.

    $data = new stdClass();
    $a    = new stdClass();

    $transaction = array();

$transaction is not used, you could remove the assignment.

    $plugin = enrol_get_plugin('pagseguro');

    $userid   = (int) isset($USER->id) && !empty($USER->id) ? $USER->id : null;
    $courseid = (int) isset($course->id) && !empty($course->id) ? $course->id : $cid;

    $transaction_xml = unserialize($transaction_data);
    $transaction = json_decode(json_encode(simplexml_load_string($transaction_xml)));

    if($transaction) {
        foreach ($transaction as $trans_key => $trans_value) {
            $trans_key = strtolower($trans_key);
            if(!is_object($trans_value)) {
                $data->$trans_key = $trans_value;
            } else {
                foreach($trans_value as $key => $value) {
                    $key = strtolower($key);
                    if(is_object($value)) {
                        foreach($value as $k => $v) {
                            $k = strtolower($k);
                            $k = $trans_key.'_'.$key.'_'.$k;
                            $data->$k = $v;
                        }
                    } else {
                        $key = $trans_key.'_'.$key;
                        $data->$key = $value;
                    }
                }
            }
        }
    } else {
        return false;
    }

    $data->xmlstring        = trim(htmlentities($transaction_xml));
    $data->business         = $plugin->get_config('pagsegurobusiness');
    $data->receiver_email   = $plugin->get_config('pagsegurobusiness');
    $data->userid           = $userid;
    $data->courseid         = $courseid;
    $data->instanceid       = $instanceid;
    $data->timeupdated      = time();

    if(!isset($data->reference) && empty($data->reference)) {
        $data->reference    = $plugin->get_config('pagsegurobusiness');
    }

    // Get the user and course records.

    if (!$user = $DB->get_record("user", array("id" => $data->userid))) {
        message_pagseguro_error_to_admin("Not a valid user id", $data);
        return false;
    }

    if (!$course = $DB->get_record("course", array("id" => $data->courseid))) {
        message_pagseguro_error_to_admin("Not a valid course id", $data);
        return false;
    }

    if (!$context = get_context_instance(CONTEXT_COURSE, $course->id)) {
        message_pagseguro_error_to_admin("Not a valid context id", $data);
        return false;
    }

    if (!$plugin_instance = $DB->get_record("enrol", array("id" => $data->instanceid, "status" => 0))) {
        message_pagseguro_error_to_admin("Not a valid instance id", $data);
        return false;
    }

    /*
       Transaction Status -
       -- Waiting for Payment - 1
       -- In analysis - 2
       -- PAID - 3
       -- Available - 4
       -- In dispute - 5
       -- Returned - 6
       -- Cancelled - 7
     */

    switch ($data->status) {
        case COMMERCE_PAGSEGURO_STATUS_AWAITING: // Awaiting payment.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_PENDING;
            break;
        case COMMERCE_PAGSEGURO_STATUS_IN_ANALYSIS: // Payment in analysis.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_PENDING;
            break;
        case COMMERCE_PAGSEGURO_STATUS_PAID: // Paid.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_SUCCESS;
            break;
        case COMMERCE_PAGSEGURO_STATUS_AVAILABLE: // Available.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_SUCCESS;
            break;
        case COMMERCE_PAGSEGURO_STATUS_DISPUTED: // Payment disputed.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_FAILURE;
            break;
        case COMMERCE_PAGSEGURO_STATUS_REFUNDED: // Payment refunded.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_FAILURE;
            break;
        case COMMERCE_PAGSEGURO_STATUS_CANCELED: // Payment canceled.
            $data->payment_status = COMMERCE_PAYMENT_STATUS_FAILURE;
            break;
    }

    if (!in_array($data->status, array(COMMERCE_PAGSEGURO_STATUS_IN_ANALYSIS, COMMERCE_PAGSEGURO_STATUS_PAID, COMMERCE_PAGSEGURO_STATUS_AVAILABLE))) {
        $plugin->unenrol_user($plugin_instance, $data->userid);
        message_pagseguro_error_to_admin("Status not completed or pending. User unenrolled from course", $data);
        $error_returnurl .= "?id={$courseid}&waiting=1";

The variable $error_returnurl does not exist. Did you forget to declare it?

        header("Location: $error_returnurl");
    }

    /*if ($existing = $DB->get_record("enrol_pagseguro", array("txn_id" => $data->txn_id))) {   // Make sure this transaction doesn't exist already

63% of this comment could be valid code. Did you maybe forget this after debugging?

      message_pagseguro_error_to_admin("Transaction $data->txn_id is being repeated!", $data);
      return false;
      }*/

    $coursecontext = get_context_instance(CONTEXT_COURSE, $course->id);

    // Check that amount paid is the correct amount
    if ( (float) $plugin_instance->cost <= 0 ) {
        $cost = (float) $plugin->get_config('cost');
    } else {
        $cost = (float) $plugin_instance->cost;
    }

    if ($data->grossamount < $cost) {
        $cost = format_float($cost, 2);
        message_pagseguro_error_to_admin("Amount paid is not enough ($data->payment_gross < $cost))", $data);
        return false;
    }

    // All clear!
    $DB->insert_record("enrol_pagseguro", $data);

    if ($plugin_instance->enrolperiod) {
        $timestart = time();
        $timeend   = $timestart + $plugin_instance->enrolperiod;
    } else {
        $timestart = 0;
        $timeend   = 0;
    }

    // Enrol user
    $plugin->enrol_user($plugin_instance, $userid, $plugin_instance->roleid, $timestart, $timeend);

    // Pass $view=true to filter hidden caps if the user cannot see them
    if ($users = get_users_by_capability($context, 'moodle/course:update', 'u.*', 'u.id ASC',

This code seems to be duplicated across your project.

                '', '', '', '', false, true)) {
        $users = sort_by_roleassignment_authority($users, $context);
        $teacher = array_shift($users);
    } else {
        $teacher = get_admin();
    }

    $mailstudents = $plugin->get_config('mailstudents');
    $mailteachers = $plugin->get_config('mailteachers');
    $mailadmins   = $plugin->get_config('mailadmins');
    $shortname = format_string($course->shortname, true, array('context' => $context));

    if (!empty($mailstudents)) {

This code seems to be duplicated across your project.

        $a->coursename = format_string($course->fullname, true, array('context' => $coursecontext));
        $a->profileurl = "$CFG->wwwroot/user/view.php?id=$user->id";

        $eventdata = new stdClass();
        $eventdata->modulename        = 'moodle';
        $eventdata->component         = 'enrol_pagseguro';
        $eventdata->name              = 'pagseguro_enrolment';
        $eventdata->userfrom          = $teacher;
        $eventdata->userto            = $user;
        $eventdata->subject           = get_string("enrolmentnew", 'enrol', $shortname);
        $eventdata->fullmessage       = get_string('welcometocoursetext', '', $a);
        $eventdata->fullmessageformat = FORMAT_PLAIN;
        $eventdata->fullmessagehtml   = '';
        $eventdata->smallmessage      = '';
        message_send($eventdata);
    }

    if (!empty($mailteachers)) {

This code seems to be duplicated across your project.

        $a->course = format_string($course->fullname, true, array('context' => $coursecontext));
        $a->user = fullname($user);

        $eventdata = new stdClass();
        $eventdata->modulename        = 'moodle';
        $eventdata->component         = 'enrol_pagseguro';
        $eventdata->name              = 'pagseguro_enrolment';
        $eventdata->userfrom          = $user;
        $eventdata->userto            = $teacher;
        $eventdata->subject           = get_string("enrolmentnew", 'enrol', $shortname);
        $eventdata->fullmessage       = get_string('enrolmentnewuser', 'enrol', $a);
        $eventdata->fullmessageformat = FORMAT_PLAIN;
        $eventdata->fullmessagehtml   = '';
        $eventdata->smallmessage      = '';
        message_send($eventdata);
    }

    if (!empty($mailadmins)) {
        $a->course = format_string($course->fullname, true, array('context' => $coursecontext));
        $a->user = fullname($user);
        $admins = get_admins();
        foreach ($admins as $admin) {
            $eventdata = new stdClass();
            $eventdata->modulename        = 'moodle';
            $eventdata->component         = 'enrol_pagseguro';
            $eventdata->name              = 'pagseguro_enrolment';
            $eventdata->userfrom          = $user;
            $eventdata->userto            = $admin;
            $eventdata->subject           = get_string("enrolmentnew", 'enrol', $shortname);
            $eventdata->fullmessage       = get_string('enrolmentnewuser', 'enrol', $a);
            $eventdata->fullmessageformat = FORMAT_PLAIN;
            $eventdata->fullmessagehtml   = '';
            $eventdata->smallmessage      = '';

            message_send($eventdata);
        }
    }

    $success_returnurl = $CFG->wwwroot.'/enrol/pagseguro/return.php?id='.$courseid;
    header("Location: $success_returnurl");
}

function message_pagseguro_error_to_admin($subject, $data) {
    $admin = get_admin();
    $site = get_site();

    $message = "$site->fullname:  Transaction failed.\n\n$subject\n\n";

    $message .= serialize($data);

    $eventdata = new stdClass();
    $eventdata->modulename        = 'moodle';
    $eventdata->component         = 'enrol_pagseguro';
    $eventdata->name              = 'pagseguro_enrolment';
    $eventdata->userfrom          = $admin;
    $eventdata->userto            = $admin;
    $eventdata->subject           = "pagseguro ERROR: ".$subject;
    $eventdata->fullmessage       = $message;
    $eventdata->fullmessageformat = FORMAT_PLAIN;
    $eventdata->fullmessagehtml   = '';
    $eventdata->smallmessage      = '';
    message_send($eventdata);
}