Reply to thread

Message

<blockquote data-quote="MasterJiq" data-source="post: 397077" data-attributes="member: 69646">I don't find any email actually, just find &quot; payer_mail &quot; ?[CODE]&lt;?phpheader(&quot;Expires: Mon, 26 Jul 1997 05:00:00 GMT&quot;);header(&quot;Last-Modified: &quot; . gmdate(&quot;D, d M Y H:i:s&quot;) . &quot;GMT&quot;);header(&quot;Cache-Control: no-store, no-cache, must-revalidate&quot;);header(&quot;Cache-Control: post-check=0, pre-check=0&quot;, false);header(&quot;Pragma: no-cache&quot;);//header(&quot;HTTP/1.1 200 OK&quot;);use PayPalIPN;$ipn = new PayPalIPN();$orderPlaced = true;// Set the response array$response = ['status' =&gt; 'false', 'title' =&gt; 'Payment Error', 'message' =&gt; ''];$verified = $ipn-&gt;verifyIPN();if($verified) {&nbsp; &nbsp; $username = Users::$Session-&gt;Name;&nbsp; &nbsp; // Payment has been verified, so get details&nbsp; &nbsp; $payer_email&nbsp; = $_POST['payer_email'];&nbsp; &nbsp; $verify_sign&nbsp; = $_POST['verify_sign'];&nbsp; &nbsp; $txn_id&nbsp; &nbsp; &nbsp;&nbsp; = $_POST['txn_id'];&nbsp; &nbsp; $payment_date = $_POST['payment_date'];&nbsp; &nbsp; $package&nbsp; &nbsp; &nbsp; = $_POST['item_number'];&nbsp; &nbsp; $amount&nbsp; &nbsp; &nbsp;&nbsp; = $_POST['payment_gross'];&nbsp; &nbsp; $item_name&nbsp; &nbsp; = $_POST['item_name'];&nbsp; &nbsp; // Make sure the transaction id has not already been used&nbsp; &nbsp; $stmt = CMS::$MySql-&gt;Query(&quot;SELECT `id` FROM `cms_transactions` WHERE `transaction_id` = :tid LIMIT 1&quot;);&nbsp; &nbsp; $stmt-&gt;bindParam(':tid', $txn_id, $db-&gt;PARAM_STR);&nbsp; &nbsp; $stmt-&gt;execute();&nbsp; &nbsp; if($stmt-&gt;rowCount() &lt; 1) {&nbsp; &nbsp; &nbsp; &nbsp; // If the transaction id has not been used, match the package id against the one in db.&nbsp; &nbsp; &nbsp; &nbsp; $stmt = CMS::$MySql-&gt;Query(&quot;SELECT `diamonds` FROM `cms_diamond_packages` WHERE `id` = :id AND `price` = :a LIMIT 1&quot;);&nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;bindParam(':id', $package, $db-&gt;PARAM_INT);&nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;bindParam(':a', $amount, $db-&gt;PARAM_STR);&nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;execute();&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; if($stmt-&gt;rowCount() &gt; 0) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $diamonds = $stmt-&gt;fetchColumn();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Payment has been successfully placed, insert it into the transactions table.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt = CMS::$MySql-&gt;Query(&quot;INSERT INTO `cms_transactions` (`user_id`,`gateway`,`transaction_id`,`amount`,`package`,`email`,`nonce`,`purchase_date`) VALUES (:uid,:g,:tid,:a,:p,:e,:n,:d)&quot;);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $data = [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':uid' =&gt; Users::$Session-&gt;Data['id'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':g'&nbsp;&nbsp; =&gt; 'paypal',&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':tid' =&gt; $txn_id,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':a'&nbsp;&nbsp; =&gt; $amount,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':p'&nbsp;&nbsp; =&gt; $package,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':e'&nbsp;&nbsp; =&gt; $payer_email,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':n'&nbsp;&nbsp; =&gt; $verify_sign,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ':d'&nbsp;&nbsp; =&gt; NULL&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt-&gt;execute($data);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Give user paid currencies or VIP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;updateUser($uid, 'diamonds', ($users-&gt;getUserInfo($uid, 'diamonds') + $diamonds));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(!$users-&gt;hasBadge($uid, 'SDB01')) // If user doesn't have badge give it to them&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;giveUserBadge($uid, 'SDB01');&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Set response to success&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $response['status']&nbsp; = &quot;true&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $response['title']&nbsp;&nbsp; = &quot;Payment Success&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $response['message'] = 'You have successfully bought '.$diamonds.' &lt;img src=&quot;'.$url.'/static/img/diamonds.png&quot; /&gt;.&lt;br /&gt; You can buy all sorts of things with diamonds. Visit our other shops to buy credits, duckets, rares, boxes, VIP etc.';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Put log as success&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ipn-&gt;putLog(&quot;SUCCESS&quot;, json_encode($_POST, true));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ipn-&gt;putLog(&quot;SUCCESS&quot;, &quot;User {$username} has successfully bought package {$package} containing {$diamonds} with a price of {$amount} using payer email {$payer_email} on {$payment_date} with ID: {$txn_id}&quot;);&nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; // Put log as the user trying to exploit the system by changing price for a package&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $response['message'] = &quot;Package ID doesn't match its pricetag: {$verified}&quot;;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $ipn-&gt;putLog(&quot;ERROR&quot;, &quot;User {$username} tried to spoof {$package} with price {$amount} using transaction id {$txn_id} with payer email {$payer_email} on {$payment_date}.&quot;);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; // User tried to duplicate this package, set the response and put the error log&nbsp; &nbsp; &nbsp; &nbsp; $response['message'] = &quot;You have already bought a package using this Transaction ID once &lt;b&gt;{$txn_id}&lt;/b&gt;.&quot;;&nbsp; &nbsp; &nbsp; &nbsp; $ipn-&gt;putLog(&quot;ERROR&quot;, &quot;User {$username} tried to duplicate package {$package} using transaction id {$txn_id} with payer email {$payer_email} on {$payment_date}.&quot;);&nbsp; &nbsp; }} else {&nbsp; &nbsp; $orderPlaced = false;}&nbsp;?&gt;[/CODE]</blockquote>

[QUOTE="MasterJiq, post: 397077, member: 69646"] I don't find any email actually, just find " payer_mail " ? [CODE]<?php header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); header("Last-Modified: " . gmdate("D, d M Y H:i:s") . "GMT"); header("Cache-Control: no-store, no-cache, must-revalidate"); header("Cache-Control: post-check=0, pre-check=0", false); header("Pragma: no-cache"); //header("HTTP/1.1 200 OK"); use PayPalIPN; $ipn = new PayPalIPN(); $orderPlaced = true; // Set the response array $response = ['status' => 'false', 'title' => 'Payment Error', 'message' => '']; $verified = $ipn->verifyIPN(); if($verified) { $username = Users::$Session->Name; // Payment has been verified, so get details $payer_email = $_POST['payer_email']; $verify_sign = $_POST['verify_sign']; $txn_id = $_POST['txn_id']; $payment_date = $_POST['payment_date']; $package = $_POST['item_number']; $amount = $_POST['payment_gross']; $item_name = $_POST['item_name']; // Make sure the transaction id has not already been used $stmt = CMS::$MySql->Query("SELECT `id` FROM `cms_transactions` WHERE `transaction_id` = :tid LIMIT 1"); $stmt->bindParam(':tid', $txn_id, $db->PARAM_STR); $stmt->execute(); if($stmt->rowCount() < 1) { // If the transaction id has not been used, match the package id against the one in db. $stmt = CMS::$MySql->Query("SELECT `diamonds` FROM `cms_diamond_packages` WHERE `id` = :id AND `price` = :a LIMIT 1"); $stmt->bindParam(':id', $package, $db->PARAM_INT); $stmt->bindParam(':a', $amount, $db->PARAM_STR); $stmt->execute(); if($stmt->rowCount() > 0) { $diamonds = $stmt->fetchColumn(); // Payment has been successfully placed, insert it into the transactions table. $stmt = CMS::$MySql->Query("INSERT INTO `cms_transactions` (`user_id`,`gateway`,`transaction_id`,`amount`,`package`,`email`,`nonce`,`purchase_date`) VALUES (:uid,:g,:tid,:a,:p,:e,:n,:d)"); $data = [ ':uid' => Users::$Session->Data['id'], ':g' => 'paypal', ':tid' => $txn_id, ':a' => $amount, ':p' => $package, ':e' => $payer_email, ':n' => $verify_sign, ':d' => NULL ]; $stmt->execute($data); // Give user paid currencies or VIP $users->updateUser($uid, 'diamonds', ($users->getUserInfo($uid, 'diamonds') + $diamonds)); if(!$users->hasBadge($uid, 'SDB01')) // If user doesn't have badge give it to them $users->giveUserBadge($uid, 'SDB01'); // Set response to success $response['status'] = "true"; $response['title'] = "Payment Success"; $response['message'] = 'You have successfully bought '.$diamonds.' <img src="'.$url.'/static/img/diamonds.png" />. You can buy all sorts of things with diamonds. Visit our other shops to buy credits, duckets, rares, boxes, VIP etc.'; // Put log as success $ipn->putLog("SUCCESS", json_encode($_POST, true)); $ipn->putLog("SUCCESS", "User {$username} has successfully bought package {$package} containing {$diamonds} with a price of {$amount} using payer email {$payer_email} on {$payment_date} with ID: {$txn_id}"); } else { // Put log as the user trying to exploit the system by changing price for a package $response['message'] = "Package ID doesn't match its pricetag: {$verified}"; $ipn->putLog("ERROR", "User {$username} tried to spoof {$package} with price {$amount} using transaction id {$txn_id} with payer email {$payer_email} on {$payment_date}."); } } else { // User tried to duplicate this package, set the response and put the error log $response['message'] = "You have already bought a package using this Transaction ID once {$txn_id}."; $ipn->putLog("ERROR", "User {$username} tried to duplicate package {$package} using transaction id {$txn_id} with payer email {$payer_email} on {$payment_date}."); } } else { $orderPlaced = false; } ?>[/CODE] [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members