karson /
mpesa-php-sdk
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Karson\MpesaPhpSdk; |
||
| 4 | |||
| 5 | use GuzzleHttp\Client; |
||
| 6 | use function GuzzleHttp\json_decode; |
||
| 7 | |||
| 8 | class Mpesa |
||
| 9 | { |
||
| 10 | |||
| 11 | private $base_uri = 'https://api.sandbox.vm.co.mz'; |
||
| 12 | private $public_key; |
||
| 13 | private $api_key; |
||
| 14 | |||
| 15 | public function __construct($config = null) |
||
| 16 | { |
||
| 17 | if (is_array($config)) { |
||
| 18 | $this->setPublicKey($config['public_key']); |
||
| 19 | $this->setApiKey($config['api_key']); |
||
| 20 | $this->setEnv($config['env']); |
||
| 21 | } |
||
| 22 | } |
||
| 23 | |||
| 24 | public function setPublicKey($public_key) |
||
| 25 | { |
||
| 26 | $this->public_key = trim($public_key); |
||
| 27 | } |
||
| 28 | |||
| 29 | public function setApiKey($api_key) |
||
| 30 | { |
||
| 31 | $this->api_key = $api_key; |
||
| 32 | } |
||
| 33 | |||
| 34 | public function setEnv($env) |
||
| 35 | { |
||
| 36 | if ($env == 'live') { |
||
| 37 | $this->base_uri = 'https://api.vm.co.mz'; |
||
| 38 | } |
||
| 39 | } |
||
| 40 | |||
| 41 | |||
| 42 | /* Standard customer-to-business transaction |
||
| 43 | * |
||
| 44 | * @param string $transactionReference This is the reference of the transaction for the customer or business making the * transaction. This can be a smartcard number for a TV subscription or a reference number of a utility bill. |
||
| 45 | * @param string $customerMSISDN MSISDN of the customer for the transaction |
||
| 46 | * @param string $amount The amount for the transaction. |
||
| 47 | * @param string $thirdPartReferece This is the unique reference of the third party system. When there are queries about transactions, this will usually be used to track a transaction. |
||
| 48 | * @param string $serviceCode Shortcode of the business where funds will be credited to. |
||
| 49 | * @return \stdClass |
||
| 50 | */ |
||
| 51 | function c2b($transactionReference, $customerMSISDN, $amount, $thirdPartReferece, $serviceCode) |
||
|
0 ignored issues
–
show
|
|||
| 52 | { |
||
| 53 | |||
| 54 | $fields = [ |
||
| 55 | "input_TransactionReference" => $transactionReference, |
||
| 56 | "input_CustomerMSISDN" => $customerMSISDN, |
||
| 57 | "input_Amount" => $amount, |
||
| 58 | "input_ThirdPartyReference" => $thirdPartReferece, |
||
| 59 | "input_ServiceProviderCode" => $serviceCode |
||
| 60 | ]; |
||
| 61 | |||
| 62 | return $this->makeRequest('/ipg/v1x/c2bPayment/singleStage/', 18352, 'POST', $fields); |
||
| 63 | } |
||
| 64 | |||
| 65 | /** |
||
| 66 | * @param $transactionID |
||
| 67 | * @param $securityCredential |
||
| 68 | * @param $initiatorIdentifier |
||
| 69 | * @param $thirdPartyReference |
||
| 70 | * @param $serviceProviderCode |
||
| 71 | * @param $reversalAmount |
||
| 72 | * @return \stdClass |
||
| 73 | */ |
||
| 74 | public function transactionReversal($transactionID, $securityCredential, $initiatorIdentifier, $thirdPartyReference, $serviceProviderCode, $reversalAmount) |
||
| 75 | { |
||
| 76 | $fields = [ |
||
| 77 | "input_TransactionID" => $transactionID, |
||
| 78 | "input_SecurityCredential" => $securityCredential, |
||
| 79 | "input_InitiatorIdentifier" => $initiatorIdentifier, |
||
| 80 | "input_ThirdPartyReference" => $thirdPartyReference, |
||
| 81 | "input_ServiceProviderCode" => $serviceProviderCode, |
||
| 82 | "input_ReversalAmount" => $reversalAmount |
||
| 83 | ]; |
||
| 84 | return $this->makeRequest('/ipg/v1x/reversal/', 18354, 'POST', $fields); |
||
| 85 | } |
||
| 86 | |||
| 87 | /** |
||
| 88 | * @param $thirdPartyReference |
||
| 89 | * @param $queryReference |
||
| 90 | * @param $serviceProviderCode |
||
| 91 | * @return \stdClass |
||
| 92 | */ |
||
| 93 | public function status($thirdPartyReference, $queryReference, $serviceProviderCode) |
||
| 94 | { |
||
| 95 | |||
| 96 | $fields = [ |
||
| 97 | 'input_ThirdPartyReference' => $thirdPartyReference, |
||
| 98 | 'input_QueryReference' => $queryReference, |
||
| 99 | 'input_ServiceProviderCode' => $serviceProviderCode |
||
| 100 | ]; |
||
| 101 | |||
| 102 | |||
| 103 | |||
| 104 | return $this->makeRequest('/ipg/v1x/queryTransactionStatus/', 18353, 'GET', $fields); |
||
| 105 | } |
||
| 106 | |||
| 107 | /** |
||
| 108 | * Generates a base64 encoded token |
||
| 109 | */ |
||
| 110 | public function getToken() |
||
| 111 | { |
||
| 112 | |||
| 113 | if (!empty($this->public_key) && !empty($this->api_key)) { |
||
| 114 | $key = "-----BEGIN PUBLIC KEY-----\n"; |
||
| 115 | $key .= wordwrap($this->public_key, 60, "\n", true); |
||
| 116 | $key .= "\n-----END PUBLIC KEY-----"; |
||
| 117 | $pk = openssl_get_publickey($key); |
||
| 118 | openssl_public_encrypt($this->api_key, $token, $pk, OPENSSL_PKCS1_PADDING); |
||
| 119 | |||
| 120 | return base64_encode($token); |
||
| 121 | } |
||
| 122 | return 'error'; |
||
| 123 | } |
||
| 124 | |||
| 125 | /** |
||
| 126 | * @param string $url |
||
| 127 | * @param string $method |
||
| 128 | * @param array $fields |
||
| 129 | * @return \stdClass |
||
| 130 | */ |
||
| 131 | private function makeRequest(string $url, int $port, string $method, array $fields = []) |
||
| 132 | { |
||
| 133 | |||
| 134 | $client = new Client([ |
||
| 135 | 'base_uri' => $this->base_uri . ':' . $port, |
||
| 136 | 'timeout' => 90, |
||
| 137 | ]); |
||
| 138 | |||
| 139 | $options = [ |
||
| 140 | 'http_errors' => false, |
||
| 141 | 'headers' => $this->getHeaders(), |
||
| 142 | 'verify' => false |
||
| 143 | ]; |
||
| 144 | |||
| 145 | if ($method == 'POST') { |
||
| 146 | $options += ['json' => $fields]; |
||
| 147 | } else { |
||
| 148 | $options += ['query' => $fields]; |
||
| 149 | } |
||
| 150 | |||
| 151 | $response = $client->request($method, $url, $options); |
||
| 152 | |||
| 153 | $return = new \stdClass(); |
||
| 154 | $return->response = json_decode($response->getBody()); |
||
| 155 | |||
| 156 | if ($return->response == false) { |
||
| 157 | $return->response = $response->getBody(); |
||
| 158 | } |
||
| 159 | |||
| 160 | |||
| 161 | $return->status = $response->getStatusCode(); |
||
| 162 | return $return; |
||
| 163 | } |
||
| 164 | |||
| 165 | /** |
||
| 166 | * @return array |
||
| 167 | */ |
||
| 168 | private function getHeaders() |
||
| 169 | { |
||
| 170 | $headers = [ |
||
| 171 | 'Content-Type' => 'application/json', |
||
| 172 | 'Authorization' => 'Bearer ' . $this->getToken(), |
||
| 173 | 'origin' => 'developer.mpesa.vm.co.mz', |
||
| 174 | 'Connection' => 'keep-alive' |
||
| 175 | ]; |
||
| 176 | return $headers; |
||
| 177 | } |
||
| 178 | } |
||
| 179 |
Adding explicit visibility (
private,protected, orpublic) is generally recommend to communicate to other developers how, and from where this method is intended to be used.