From mwillis at #524538: Correct string length for X-VPS-Request-ID:

Within uc_payflowpro.module for 5.x and 6.x, check out the formation of $xml_request prior to it's use in the sha1(). I think within _uc_payflowpro_submit_xml one meant to pass along $xml_request (or $xml) but it was switched up at some point.

Comments

kwinters’s picture

kwinters commented
Status: Active » Needs review

Good catch. Since the part of the md5 that should actually be unique was always NULL, any two transactions that happen during the same second would have been considered duplicates.

Committed to both D6 and D5 branches. Please check out the latest version from CVS and let me know if there are any other issues, then I'll roll a new beta version. D6 is the version you're actually using though, right?

mwillis’s picture

mwillis commented

Unfortunately I am on D5 for the time being. I will check out the latest this evening and let you know how it goes. Thanks so much for the prompt assistance.

mwillis’s picture

mwillis commented

I am not sure if for consistency's sake you want to change the $xml_request to $xml within the PayflowProRecurring.class.php for D5. Everything looks good. I do have another suggestion that I'd like to get in before you roll another beta if it's agreeable, and I will submit it shortly (nevermind I see it here http://drupal.org/node/486294 -- big pain).

kwinters’s picture

kwinters commented
Status: Needs review » Fixed

As a general rule I avoid backporting any code cleanup to avoid introducing bugs (for example when something would only work in D6). It might be OK in this case, but I don't have any way to test those blocks of code sufficiently in D5.

Made a release for D6 and D5.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.