Hi,
I'm running 4.7 on one site and had some issues with fsockopen and the donation module. While debugging I came across $fp = fsockopen($_lm_paypal_host, 80, $errno, $errstr, LM_PAYPAL_VALIDATE_TIMEOUT); and really wondered that it was connecting without encryption. Looked it up in 6.x-1.0, same here, in 6.x-2.0-alpha1 its done via drupal_http_request. Don't know too much about IPN, but it looks like its sending sensitiv information with it.
Looked it up on paypal and they recommend $fp = fsockopen ('ssl://www.paypal.com', 443, $errno, $errstr, 30); http://www.paypal.com/cgi-bin/webscr?cmd=p/pdn/ipn-codesamples-pop-outsi...
Why is the ssl connection not being used? What am I getting wrong? Don't feel to good about running it without encryption on my side at the moment.

Comments

pounard’s picture

pounard
Primary language French
commented

It seems that default behavior is SSL.

I explain, drupal_http_request() uses SSL if the given URL begins with "https://", and in our case, we always have HTTPS, it's somewhere hard-typed in the code.

Did you checked that the HTTP request is actually not HTTPS (with 6--2 version) ?

pounard’s picture

pounard
Primary language French
commented

Oh sorry, I was talking about 6--2 version! Did not see your bug report was for 6--1 version.

jdubbwya’s picture

jdubbwya commented

If you want to manage a http request with SSL I believe the best way is to use the php extension CURL. Check to see if it is installed with the server you are using, or talk to your site adminitrator to install it. I was of the understanding that the standard fsockopen doesn't do the SSL handshake for you automatically. I have always had to use CURL in the past.

ti2m’s picture

ti2m commented

Hi,
ok thanks for the info about drupal_http_request(). But it looks like in all other versions (4.7,5.x,6.x-1.0) it connects with fsockopen($_lm_paypal_host, 80, $errno, $errstr, LM_PAYPAL_VALIDATE_TIMEOUT); I don't see how drupal or php could (should) turn that into an ssl connection, or to put in another way, why should it if we can directly connect over ssl. So, back to my question, why is that line not being replaced by fsockopen ('ssl://www.paypal.com', 443, $errno, $errstr, 30); as recommended on paypal. I don't see how that is not a security issue or why it shouldnt be replaced.

pounard’s picture

pounard
Primary language French
commented
Assigned: Unassigned » lyricnz

I assign this bug to the older versions dev.

lyricnz’s picture

lyricnz commented
Assigned: lyricnz » Unassigned
Status: Active » Postponed (maintainer needs more info)

Ha pounard! Are you getting back at me for that comment in another issue?

I'm not inclined to change the existing behaviour of the module, out of concern for breaking existing working installations (firewalls, fake-paypal backends, ssl-certificate missmatches, etc). If someone wants to submit a patch that adds a checkbox to the configuration screen, that enables SSL (and this defaults to OFF), then I'll review it.

vitis’s picture

vitis commented

subscribing

Leeteq’s picture

Leeteq commented

#2: So the upcoming 2.x release does SSL only if the site or the current URL is HTTPS, and if not, will connect insecurely as version 1.0 is doing now??

lyricnz’s picture

lyricnz commented

There's really no big deal about SSL, and it's not "insecure":

1) this module is NOT involved in accepting credit-card details from the user at all, this is done on paypal.com

2) paypal sends a HTTP request back to the drupal site, using plain HTTP, containing an XML document. There's no credit-card information in this request (the IPN - Incoming Payment Notification)

3) the drupal site sends the request back to paypal, to verify that the IPN was valid, and not spoofed (IPN validation)

So the only thing we're talking about here, and have control over, is #3. Since #2 was just sent to us, and the content in #3 is the same data.

In any case, in 2.x, if you put a hostname in /admin/settings/lm_paypal/settings, it will use HTTPS/SSL: 'https://'.$hostname.'/cgi-bin/webscr'. If you put a full URL, it'll use that instead.

john franklin’s picture

john franklin commented
Status: Postponed (maintainer needs more info) » Closed (duplicate)

Duplicate of #883242: lm_paypal_donations and sandbox - "Please login to use the PayPal Sandbox features.".

john franklin’s picture

john franklin commented
Status: Closed (duplicate) » Postponed (maintainer needs more info)

Sorry. Thought this was a different issue.

mcary’s picture

mcary commented

I also agree that the connection should be over SSL. In fact, in the last few months, Paypal started *requiring* this connection to be over SSL (HTTPS). I've submitted a patch to use SSL on 4.x-6.x on another ticket.

john franklin’s picture

john franklin commented
Status: Postponed (maintainer needs more info) » Fixed

Version 2.0 of the module has used SSL for some time now.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.