opened
judgej
username_0
I hope the test coverage is enough. See what you think.

The DPM and SIM callback hash checks are supposed to work the same way. However, I am not convinced the SIM version does the right thing. In the callback, the hash should be against the shared secret and login ID, supplied by the merchant site, and the transaction reference and amount, supplied by the gateway in the callback POST data.That is how I have set up the DPM hash check. The SIM hash check looks at the amount supplied by the merchant site rather than in the POST data (which is arguiably fine as a check, *but* will product the wrong and less useful exception if that check fails), and the transaction id supplied by the merchant site. That second one is most definitely wrong - it should be the transaction reference, and that is only known for the first time in the callback as it is supplied as POST data (x_trans_id).

I don't want to break sites already using SIM that have probably got a workaround in place, so the DPM hash is coded differently, and is used differently.
DPM support for Authorize.Net
issue
created
judgej
username_0
I'm not sure where we left this. Is it still waiting for something from me? It's been in production for me for a few months, with over $300k in approved transactions, so I'm confident that it's working, though that doesn't mean I have not missed out some test coverage.
comment
created
kayladnls
username_1
:+1: Thank you @username_0
comment
created
judgej
username_0
Well, I'm not going to be able to sleep tonight now. Thanks :-)
comment
created
kayladnls
username_1
but... why?
comment
created
judgej
username_0
Just new code hitting the big, wide world. They grow up so fast, but always come back crying when they fall over.
comment