This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Yii2 extension for payment processing with Omnipay, Payum and more later. |
||
4 | * |
||
5 | * @link https://github.com/hiqdev/yii2-merchant |
||
6 | * @package yii2-merchant |
||
7 | * @license BSD-3-Clause |
||
8 | * @copyright Copyright (c) 2015-2017, HiQDev (http://hiqdev.com/) |
||
9 | */ |
||
10 | |||
11 | namespace hiqdev\yii2\merchant; |
||
12 | |||
13 | use hiqdev\yii2\merchant\models\DepositForm; |
||
14 | use hiqdev\yii2\merchant\controllers\PayController; |
||
15 | use hiqdev\yii2\merchant\models\DepositRequest; |
||
16 | use hiqdev\yii2\merchant\models\PurchaseRequest; |
||
17 | use hiqdev\yii2\merchant\transactions\Transaction; |
||
18 | use hiqdev\yii2\merchant\transactions\TransactionException; |
||
19 | use hiqdev\yii2\merchant\transactions\TransactionRepositoryInterface; |
||
20 | use Yii; |
||
21 | use yii\base\InvalidConfigException; |
||
22 | use yii\helpers\Url; |
||
23 | |||
24 | /** |
||
25 | * Merchant Module. |
||
26 | * |
||
27 | * Example application configuration: |
||
28 | * |
||
29 | * ```php |
||
30 | * 'modules' => [ |
||
31 | * 'merchant' => [ |
||
32 | * 'class' => 'hiqdev\yii2\merchant\Module', |
||
33 | * 'notifyPage' => '/my/notify/page', |
||
34 | * 'collection' => [ |
||
35 | * 'PayPal' => [ |
||
36 | * 'purse' => $params['paypal_purse'], |
||
37 | * 'secret' => $params['paypal_secret'], /// NEVER keep secret in source control |
||
38 | * ], |
||
39 | * 'webmoney_usd' => [ |
||
40 | * 'gateway' => 'WebMoney', |
||
41 | * 'purse' => $params['webmoney_purse'], |
||
42 | * 'secret' => $params['webmoney_secret'], /// NEVER keep secret in source control |
||
43 | * ], |
||
44 | * ], |
||
45 | * ], |
||
46 | * ], |
||
47 | * ``` |
||
48 | * |
||
49 | * @var string returns username for usage in merchant |
||
50 | */ |
||
51 | class Module extends \yii\base\Module |
||
52 | { |
||
53 | /** |
||
54 | * The URL prefix that will be used as a key to save current URL in the session. |
||
55 | * |
||
56 | * @see rememberUrl() |
||
57 | * @see previousUrl() |
||
58 | * @see \yii\helpers\BaseUrl::remember() |
||
59 | * @see \yii\helpers\BaseUrl::previous() |
||
60 | */ |
||
61 | const URL_PREFIX = 'merchant_url_'; |
||
62 | |||
63 | /** |
||
64 | * @var string|class-string<Collection> merchant collection class name. Defaults to [[Collection]] |
||
65 | */ |
||
66 | public $purchaseRequestCollectionClass = Collection::class; |
||
67 | /** |
||
68 | * @var string currencies collection class name. Defaults to [[Collection]] |
||
69 | */ |
||
70 | public $currenciesCollectionClass; |
||
71 | /** |
||
72 | * @var string Deposit model class name. Defaults to [[DepositForm]] |
||
73 | */ |
||
74 | public $depositFromClass = DepositForm::class; |
||
75 | /** |
||
76 | * @var bool Whether to use payment processing only through Cashew |
||
77 | */ |
||
78 | public bool $cashewOnly = false; |
||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||
79 | /** |
||
80 | * @var TransactionRepositoryInterface |
||
81 | */ |
||
82 | protected $transactionRepository; |
||
83 | |||
84 | public function __construct($id, $parent = null, TransactionRepositoryInterface $transactionRepository, array $config = []) |
||
85 | { |
||
86 | parent::__construct($id, $parent, $config); |
||
87 | |||
88 | $this->transactionRepository = $transactionRepository; |
||
89 | } |
||
90 | |||
91 | public function setCollection(array $collection) |
||
92 | { |
||
93 | $this->_collection = $collection; |
||
94 | } |
||
95 | |||
96 | /** |
||
97 | * @param DepositRequest $depositRequest |
||
98 | * @return Collection |
||
99 | * @throws InvalidConfigException |
||
100 | */ |
||
101 | public function getPurchaseRequestCollection($depositRequest = null) |
||
102 | { |
||
103 | return Yii::createObject([ |
||
104 | 'class' => $this->purchaseRequestCollectionClass, |
||
105 | 'module' => $this, |
||
106 | 'depositRequest' => $depositRequest, |
||
107 | ]); |
||
108 | } |
||
109 | |||
110 | /** |
||
111 | * @return Currencies |
||
112 | * @throws InvalidConfigException |
||
113 | */ |
||
114 | public function getAvailableCurrenciesCollection(): Currencies |
||
115 | { |
||
116 | return Yii::createObject([ |
||
117 | 'class' => $this->currenciesCollectionClass, |
||
118 | 'module' => $this, |
||
119 | ]); |
||
120 | } |
||
121 | |||
122 | /** |
||
123 | * @param string $merchant_name merchant id |
||
124 | * @param DepositRequest $depositRequest |
||
125 | * @return PurchaseRequest merchant instance |
||
126 | */ |
||
127 | public function getPurchaseRequest($merchant_name, DepositRequest $depositRequest) |
||
128 | { |
||
129 | return $this->getPurchaseRequestCollection($depositRequest)->get($merchant_name); |
||
130 | } |
||
131 | |||
132 | /** |
||
133 | * Checks if merchant exists in the hub. |
||
134 | * |
||
135 | * @param string $id merchant id |
||
136 | * @return bool whether merchant exist |
||
137 | */ |
||
138 | public function hasPurchaseRequest($id) |
||
139 | { |
||
140 | return $this->getPurchaseRequestCollection()->has($id); |
||
141 | } |
||
142 | |||
143 | /** |
||
144 | * Method builds data for merchant request. |
||
145 | * |
||
146 | * @param DepositRequest $depositRequest |
||
147 | */ |
||
148 | public function prepareRequestData($depositRequest): void |
||
149 | { |
||
150 | $depositRequest->username = $this->getUsername(); |
||
151 | $depositRequest->notifyUrl = $this->buildUrl('notify', $depositRequest); |
||
152 | $depositRequest->returnUrl = $this->buildUrl('return', $depositRequest); |
||
153 | $depositRequest->cancelUrl = $this->buildUrl('cancel', $depositRequest); |
||
154 | $depositRequest->finishUrl = $this->buildUrl('finish', $depositRequest); |
||
155 | } |
||
156 | |||
157 | /** |
||
158 | * @var string client login |
||
159 | */ |
||
160 | protected $_username; |
||
161 | |||
162 | /** |
||
163 | * Sets [[_username]]. |
||
164 | * |
||
165 | * @param $username |
||
166 | */ |
||
167 | public function setUsername($username) |
||
168 | { |
||
169 | $this->_username = $username; |
||
170 | } |
||
171 | |||
172 | /** |
||
173 | * Gets [[_username]] when defined, otherwise - `Yii::$app->user->identity->username`, |
||
174 | * otherwise `Yii::$app->user->identity->getId()`. |
||
175 | * @throws InvalidConfigException |
||
176 | * @return string |
||
177 | */ |
||
178 | public function getUsername() |
||
179 | { |
||
180 | if (isset($this->_username)) { |
||
181 | return $this->_username; |
||
182 | } elseif (($identity = Yii::$app->user->identity) !== null) { |
||
183 | if ($identity->hasProperty('username')) { |
||
184 | $this->_username = $identity->username; |
||
185 | } else { |
||
186 | $this->_username = $identity->getId(); |
||
187 | } |
||
188 | |||
189 | return $this->_username; |
||
190 | } |
||
191 | throw new InvalidConfigException('Unable to determine username'); |
||
192 | } |
||
193 | |||
194 | /** |
||
195 | * @var string|array the URL that will be used for payment system notifications. Will be passed through [[Url::to()]] |
||
196 | */ |
||
197 | public $notifyPage = 'notify'; |
||
198 | /** |
||
199 | * @var string|array the URL that will be used to redirect client from the merchant after the success payment. |
||
200 | * Will be passed through [[Url::to()]] |
||
201 | */ |
||
202 | public $returnPage = 'return'; |
||
203 | /** |
||
204 | * @var string|array the URL that will be used to redirect client from the merchant after the failed payment. |
||
205 | * Will be passed through [[Url::to()]] |
||
206 | */ |
||
207 | public $cancelPage = 'cancel'; |
||
208 | /** |
||
209 | * @var string|array the URL that might be used to redirect used from the success or error page to the finish page. |
||
210 | * Will be passed through [[Url::to()]] |
||
211 | */ |
||
212 | public $finishPage = 'finish'; |
||
213 | |||
214 | /** |
||
215 | * Builds URLs that will be passed in the request to the merchant. |
||
216 | * |
||
217 | * @param string $destination `notify`, `return`, `cancel` |
||
218 | * @param DepositRequest $depositRequest |
||
219 | * @return string URL |
||
220 | */ |
||
221 | public function buildUrl($destination, DepositRequest $depositRequest) |
||
222 | { |
||
223 | $page = [ |
||
224 | $this->getPage($destination, $depositRequest), |
||
225 | 'username' => $depositRequest->username, |
||
226 | 'merchant' => $depositRequest->merchant, |
||
227 | 'transactionId' => $depositRequest->id, |
||
228 | ]; |
||
229 | |||
230 | if (is_array($page)) { |
||
231 | $page[0] = $this->localizePage($page[0]); |
||
232 | } else { |
||
233 | $page = $this->localizePage($page); |
||
234 | } |
||
235 | |||
236 | return Url::to($page, true); |
||
237 | } |
||
238 | |||
239 | /** |
||
240 | * Builds url to `this_module/pay/$page` if page is not /full/page. |
||
241 | * @param mixed $page |
||
242 | * @return mixed |
||
243 | */ |
||
244 | public function localizePage($page) |
||
245 | { |
||
246 | return is_string($page) && $page[0] !== '/' ? ('/' . $this->id . '/pay/' . $page) : $page; |
||
247 | } |
||
248 | |||
249 | public function getPage($destination, DepositRequest $depositRequest) |
||
250 | { |
||
251 | $property = $destination . 'Url'; |
||
252 | if ($depositRequest->$property) { |
||
253 | return $depositRequest->$property; |
||
254 | } |
||
255 | |||
256 | $name = $destination . 'Page'; |
||
257 | |||
258 | return $this->hasProperty($name) ? $this->{$name} : $destination; |
||
259 | } |
||
260 | |||
261 | /** |
||
262 | * Saves the $url to session with [[URL_PREFIX]] key, trailed with $name. |
||
263 | * |
||
264 | * @param array|string $url |
||
265 | * @param string $name the trailing part for the URL save key. Defaults to `back` |
||
266 | * @void |
||
267 | */ |
||
268 | public function rememberUrl($url, $name = 'back') |
||
269 | { |
||
270 | Url::remember($url, static::URL_PREFIX . $name); |
||
271 | } |
||
272 | |||
273 | /** |
||
274 | * Extracts the URL from session storage, saved with [[URL_PREFIX]] key, trailed with $name. |
||
275 | * |
||
276 | * @param string $name the trailing part for the URL save key. Defaults to `back` |
||
277 | * @return string |
||
278 | */ |
||
279 | public function previousUrl($name = 'back') |
||
280 | { |
||
281 | return Url::previous(static::URL_PREFIX . $name); |
||
282 | } |
||
283 | |||
284 | /** |
||
285 | * @var PayController The Payment controller |
||
286 | */ |
||
287 | protected $_payController; |
||
288 | |||
289 | /** |
||
290 | * @throws InvalidConfigException |
||
291 | * |
||
292 | * @return PayController |
||
293 | */ |
||
294 | public function getPayController() |
||
295 | { |
||
296 | if ($this->_payController === null) { |
||
297 | $this->_payController = $this->createControllerById('pay'); |
||
298 | } |
||
299 | |||
300 | return $this->_payController; |
||
301 | } |
||
302 | |||
303 | /** |
||
304 | * Renders page, that contains list of payment systems, that might be choosen by user. |
||
305 | * Should be implemented in `PayController`. |
||
306 | * |
||
307 | * @param DepositForm $form |
||
308 | * @return \yii\web\Response |
||
309 | */ |
||
310 | public function renderDeposit($form) |
||
311 | { |
||
312 | return $this->getPayController()->renderDeposit($form); |
||
313 | } |
||
314 | |||
315 | /** |
||
316 | * @param Transaction $transaction |
||
317 | * @return Transaction |
||
318 | */ |
||
319 | public function saveTransaction($transaction) |
||
320 | { |
||
321 | return $this->transactionRepository->save($transaction); |
||
322 | } |
||
323 | |||
324 | public function insertTransaction($id, $merchant, $data) |
||
325 | { |
||
326 | $transaction = $this->transactionRepository->create($id, $merchant, $data); |
||
327 | |||
328 | return $this->transactionRepository->insert($transaction); |
||
329 | } |
||
330 | |||
331 | /** |
||
332 | * @param string $id transaction ID |
||
333 | * @return Transaction|null |
||
334 | */ |
||
335 | public function findTransaction($id) |
||
336 | { |
||
337 | try { |
||
338 | return $this->transactionRepository->findById($id); |
||
339 | } catch (TransactionException $e) { |
||
340 | return null; |
||
341 | } |
||
342 | } |
||
343 | } |
||
344 |