CVS edit link for haagendazs

I would like to contribute a module that integrates the external payment processing service CCBill (http://www.ccbill.com) with Drupal.

CCBill is a service that handles credit card transactions instead of the website itself having to deal with any financial information. I am not an employee of CCBill, I am just using the CCBill service on a high-traffic site and wasn't able to find a module that integrates Drupal with CCBill, so I created one myself. I would like to share that module with the Drupal community.

CCBill provides an ancient cgi-script integration (which is NOT used in this module), and a relatively convoluted API to integrate with their service, which I am making use of. The unique identifier at CCBill is a subscription ID. This module ties a CCBill subscription ID to a Drupal User ID. The workflow looks as following:
1. User clicks on a link to get to CCBill, passing its User ID
2. User enters credit card information on CCBill
3. If credit card was verified, CCBill passes back subscription information, including Drupal User ID
4. The CCBill module stores subscription information in Drupal database and exposes this action using a custom hook (hook_ccbill($op = 'add', $ccbill)) to other modules

In regards to security, this module verifies that the data is actually passed by a CCBill server by looking at the IP address of the server posting the data.

Once a subscription expires, CCBill unfortunately doesn't pass back any data. Instead, this module is using CCBill's DataLink API. Once daily (run on cron), the module connects to the CCBill server, downloads all expirations for the previous day and processes the data, exposing it to other modules using a custom hook (hook_ccbill($op = 'expire', $ccbill)).

For Drupal site administrators, the module provides a settings section that allows site admins to enter their CCBill API account number and credentials. It also provides a test mode that will test the DataLink integration.

The module in the current state is fully functional, but knowledge of the Drupal hook system is required to integrate it with one's custom module. Moving forward, I am planning to release an add-on module that makes use of the provided hooks and integrates the CCBill module with the Rules module (so site admins can easily create a custom action once a user's subscription gets activated, such as changing that user's role) as well as the Views module (to expose a user's subscription details in a view easily).

Thanks for your consideration, I am eager to start becoming active in the Drupal community.
Daniel Hanold (a.k.a. haagendazs)

Comments

haagendazs’s picture

Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new6.41 KB
avpaderno’s picture

Issue tags: +Module review
haagendazs’s picture

StatusFileSize
new13.45 KB

I added a README.txt file to the module. Please review this latest version. Thank you!

haagendazs’s picture

StatusFileSize
new13.86 KB

I wanted to follow-up and find out long it usually takes before a module for a CVS application gets reviewed. I would love to get started contributing to the community as soon as possible. Thanks a lot for the volunteer work of reviewing modules.

Also: I improved the README.txt file and uploaded a new version of the CCBill module.

mdorman’s picture

Status: Needs review » Needs work

As I mentioned in IRC this is my first review, but I did find a few things you'll want to address. Clearly you've got a solid development background, and overall this module is quite good. I did some research, and there have been quite a few requests for CCBill integration with Drupal. Ubercart, or commerce integration would be great additions in the future.

  1. Performance: You should consider making uid an indexed column, as I saw it in the WHERE clause in at least one query.
  2. Remove the LICENSE.txt as this will be added automatically once uploaded to drupal.org.
  3. Possible Security Issue: You are storing the password unencrypted and displaying it in a plain textfield. I would think this should be encrypted and displayed in a password field.
  4. Coding Standards Warnings: Very minor, but there are quite a few lines with trailing spaces
  5. Requirements: You should probably emphasize more that this module is not stand alone, and provides essentially an API for accessing CCBill.
haagendazs’s picture

Status: Needs work » Needs review
StatusFileSize
new8.15 KB

mdorman: Thanks a lot for looking over the code and thanks for the feedback. I looked over your points:

  1. Performance: I added an index to the uid column to improve the performance
  2. I removed the LICENSE.TXT file, I wasn't sure if this was automatically added
  3. Security Issue: The issue with CCBill is that I can't "md5" the password and then store it, as CCBill needs the unencrypted password and I can't decrypt the md5'ed password before making a call to CCBill.
    I looked at a few other modules that integrate with an external service to find out how they handle password storage. The reCaptcha module, for example, also stores their API keys as plain text in the variables tables, presumably for the same reason.
    The CCBill Settings page is only accessible with the 'administer ccbill' permission, so I think that I'm following the general Drupal standards in this regard.
  4. Coding Standards: I removed the trailing spaces in the module
  5. Requirements: I modified the README.txt file a bit to focus more on the fact that this module provides a hook to react to CCBill "actions" (new subscription / expired subscription). Since the link that sends a user to the CCBill form still has to be created manually, I didn't want to call this a full API module.

Again: thanks a lot for creating this initial review and for taking the time to post your comments. I hope one of the maintainers will be able to look over this again and help me with the CVS application.

mdorman’s picture

Can someone pick this up that has approval permission? I'm quite happy with what haagendazs has submitted, but I can't take it any further.

Thanks!

avpaderno’s picture

Status: Needs review » Needs work
  • This is a partial review.
  • The points reported in this review are not in order of importance / relevance.
  • Most of the times I report the code that present an issue. In such cases, the same error can be present in other parts of the code; the fact I don't report the same issue more than once doesn't mean the same issue is not present in different places.
  • Not all the reported points are application blockers; some of the points I report are simple suggestions to who applies for a CVS account. For a list of what is considered a blocker for the application approval, see CVS applications review, what to expect. Keep in mind the list is still under construction, and can be changed to adapt it to what has been found out during code review, or to make the list clearer to who applies for a CVS account.
  1. Hook implementation comments should be like the following one:
    /**
     * Implements hook_menu().
     */
    
  2. Menu descriptions and titles, as well as schema descriptions, are not passed to t().
  3.   watchdog('ccbill', t('CCBill call registered for User ID %uid. (Subscription ID: %sub_id)'), array('%uid' => $ccbill['uid'], '%sub_id' => $ccbill['sub_id']));
    
    

    The second argument passed to the function is not correct.

  4.   // Prepare the query to insert subscription details
      $query = "INSERT INTO {ccbill} (sub_id, uid, start_date, initial_period, initial_price, rebills, recurring_period, recurring_price) VALUES ('%s', %d, %d, %d, %f, %d, %d, %f)";
    
      // Execute the query
      db_query($query,
        $ccbill['sub_id'],
        $ccbill['uid'],
        strtotime($ccbill['start_date']),
        $ccbill['initial_period'],
        $ccbill['initial_price'],
        $ccbill['rebills'],
        $ccbill['recurring_period'],
        $ccbill['recurring_price']
      );
    
    

    Why isn't the code using drupal_write_record()?

  5. The module doesn't remove the Drupal variables it defines when it is uninstalled.
haagendazs’s picture

Status: Needs work » Needs review
StatusFileSize
new8.21 KB

Hi kiamlaluno,

Thanks a lot for your partial review, I'm excited that there is progress on my CVS application.

  1. I modified the text for the hook implementations.
  2. I removed the t() function for all schema descriptions, I couldn't find any instances of t() for menu titles and descriptions.
  3. I removed the superfluous closing bracket for the watchdog call.
  4. There was no specific reason why I didn't use drupal_write_record() here. I changed this database call to use drupal_write_record.
  5. I added code to remove the variables set by this module upon module removal.

kiamlaluno: Thanks again for taking the time to look over my module. Please let me know if there's anything additional I can do to get approved for a CVS account. Danny

avpaderno’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)
Issue tags: -Module review

Automatically closed -- issue fixed for 2 weeks with no activity.