We are configuring a site so the shop part can be administered by the shop manager. We want the shop admin person to handle everything except the secure hash and some other configuration items. We also want to hide the secure hash from contractors working on themes and things not directly related to the initial payment setup. We are looking at removing the secure hash from the watchdog messages. Would that be an easy option?

We are also about to create the shop admin role. Ideally they could change the text on buttons but not access the merchant credentials. How much work would it require to add an extra permission at that level?

Comments

peterx’s picture

peterx commented

As a temporary change, I added some unsets:

      drupal_set_title(UC_MIGS_ERROR_NOT_PROCESSED);
      if(isset($_GET['vpc_SecureHash'])) { unset($_GET['vpc_SecureHash']); }
      watchdog( 'uc_migs', 'MIGS gateway rejected payment due to validation failure. $_GET was: <pre>@get</pre>', array('@get' => print_r($_GET,1)), WATCHDOG_WARNING );
xurizaemon’s picture

xurizaemon
he/him
Location Ōtepoti, Aotearoa 🏝
commented
Status: Active » Closed (won't fix)

The secure hash which the client is redirected with is not "secret" - that's the variable uc_migs_secure_hash_secret. It shouldn't be harmful to share $_GET['vpc_SecureHash'] with site admins; anyone who makes a transaction gets one, but without the secret it's not much use, and the secret is never transmitted during the transaction.

If this was a valid issue with uc_migs, it would probably be a candidate for filing a security report rather than a public issue.

I do think you've raised a couple of good points.

- One is that Ubercart could have finer-grained controls over who can access store credentials (please update here if you open such a feature request, I'll follow in).

- The other is that we should review the details logged for transactions. Having just reviewed the relevant watchdog statements, I believe that I've done that, but I welcome any review and input.

I suspect that if this code was replicated in Drupal Commerce, we *would* have a security issue in the UC_MIGS_TRANSACTION_PAYMENTERROR case, because (from memory) $order contains the payment processor details. Appreciate you putting that on my radar :)

I'm going to close this WONTFIX, but I'd be happy to collab on getting a credentials level permission into UC. Commerce has much finer-grained permissions for this sort of thing.