Use of secure token

Dave,

We reviewed the patch over email and it worked fine, except for one change: drupal_exit() is for D7 only, so this version of the patch replaces it with exit().

This patch additionally fixes an XSS vulnerability.

Longwave, it's like you're reading my mind or something. Would you mind contacting the security team with a note about this patch? I will help test this, if I can. I'm not sure we're actually going to be moving ahead with Payflow Link but it would be nice to have the option (and to have the module fully-functional at that time).

Thanks!

The security team has seen this. To be honest, it's hard to review payment gateways since they require signing up with that gateway. It would be great if someone who uses the code could review it to confirm it works and doesn't have security issues.

Hey Greggles! Thanks for the update. I will give it a test myself as soon as I can.

Can you please commit and get a new release out? Thanks!

I do not have permission to commit anything here until the security team review this.

@greggles: The patch is fairly straighforward; you can see that 'uc_payflowlink_secret_token' is only set from an admin form, and only used in the response handler.

Thanks for the work on securing this module. I have a need to run PayFlow link for a legacy system.

Can someone explain to me the 'secure token'? Is it an arbitrary value? I'm not clear on how to implement the patch once applied.

Thanks!

Yes, it is an arbitrary, secret value; you set the same value in the Payflow Link manager and the Ubercart payment settings page and do not disclose it to anyone else, so it can then be used to authenticate requests from Payflow Link.

@longwave got it. All is well. Thanks!

Until the security team approves the patch, I don't see a link on the project page to download the module. Could someone who has the module send it to me (we can exchange emails in PM)?

Thanks in advance.

@longwave - conceptually this looks good to me. My memory from the issue on s.d.o is that payflow has built a feature into their system to secure the callbacks. Is this it?

It would also be great to get some feedback from the Payflow folks themselves as they distribute a different module (I haven't looked to see if it is itself secure, but they claimed it fixed this issue).

Payflow is a PayPal service; I think you are remembering a different module with a similar security issue.

There are in fact two different Payflow Link services provided by PayPal. This module implements the legacy service, although there is a newer service available that provides better compatibility with other PayPal services. Neither of the APIs seem to document any verification method for the "Silent POST" feature, but this can still be implemented with a secret token in the URL, as in the patch in this issue.

Legacy API: https://www.x.com/sites/default/files/pp_payflowlink_guide.pdf
New API: https://www.x.com/sites/default/files/payflowgateway_guide.pdf

@longwave - right you are, I was confusing this with something else.

So...I guess this is RTBC and we should re-open the project page?

Yes, please.

Bump. @greggles can you re-assign the project node to me? I think that's all that needs to happen?

Ok, did that.

Can this project be reactivated? Thank you!

Apologies, I did not see that this had been updated until now.

I have tagged 6.x-1.2 which includes this fix. It should be available from https://drupal.org/node/2045113 shortly.