jeffharrell/MiniCart — Issue #33: Security
Author: technomaji
Created: 2011-12-05 00:29:56+00:00
State: open

So I finally got the button to work after giving in and actually reading the fine-print: "remove paypal security"

Quoted from https://github.com/jeffharrell/MiniCart:
>> I installed the Mini Cart, but my website still redirects to PayPal ...
>>> The other cause is that the Mini Cart doesn’t yet work with what PayPal’s call their “hosted” or “encrypted” buttons which is why this is most likely happening. To fix your buttons, you’ll need to log into paypal.com and do the following steps:
>>> Create a button on PayPal’s website and uncheck the Save button at PayPal checkbox under Step 2: Track inventory, profit & loss.
>>> Once you’ve created the button click Remove code protection before copying your button’s code.

I'd think that this means that any cracker/hacker could make a copy of my paypal button (from my site's `view source`), place it on a site of their own after changing the price from e.g. $200 to $0.05, and place a legitimate order?!

Am I wrong? What do you suggest? Are you currently working on integrating security so that Paypal can verify the legitimacy of a button before allowing checkout?

Other than that, I really appreciate you making this code publicly available since I'm not a programmer but am currently redeveloping my fiancées site ... provided I can make secure use of your code, be happy to make a donation ;-)

Cheers,
=) Detlev