<h2>File Contents: /home/planet5/public_html/4xpips.net/secure/library/Am/Paysystem/Transaction/Incoming.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/4xpips.net/secure/library/Am/Paysystem/Transaction/Incoming.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php

/**
 * Class represents a transaction coming from (maybe!) a paysystem
 * to direct URL, say http://site.com/amember/payment/paypal/ipn
 * it must do a serie of validating checks before it can be handled
 *
 * @see DirectController
 * @see Am_Paysystem_Abstract::directAction()
 * @see Am_Paysystem_Abstract::createTransaction()
 */
abstract class Am_Paysystem_Transaction_Incoming extends Am_Paysystem_Transaction_Abstract
{
    /** @var Am_Request */
    protected $request;
    /** @var Zend_Controller_Response_Http */
    protected $response;
    /** @var array controller invokeArgs */
    protected $invokeArgs;
    /** @var InvoiceLog */
    protected $log;
    
    /** redefine to get @link fetchUserInfo working 
     *  special keys:
     *      &quot;user_external_id&quot; - if defined, will be used by @link generateUserExternalId
     *      &quot;invoice_external_id&quot; - if defined, will be used by @link generateInvoiceExternalId
     *      &quot;name&quot; - automatically parsed to &quot;name_f&quot; and &quot;name_l&quot;
     *  @var array userField -&gt; transactionField */
    protected $_autoCreateMap = array();
    
    public function __construct(Am_Paysystem_Abstract $plugin, Am_Request $request, Zend_Controller_Response_Http $response, $invokeArgs)
    {
        $this-&gt;request = $request;
        $this-&gt;response = $response;
        $this-&gt;invokeArgs = $invokeArgs;
        parent::__construct($plugin);
    }
    
    /**
     * By transaction :
     *  - find or create user 
     *  - find or create invoice
     *  - return created invoice
     * @return Invoice
     */
    function autoCreateInvoice()
    {
        $invoiceExternalId = $this-&gt;generateInvoiceExternalId();
        $invoice = Am_Di::getInstance()-&gt;invoiceTable-&gt;findFirstByData(&#039;external_id&#039;, $invoiceExternalId);

        $products = array();
        if (!$invoice &amp;&amp; !$products = $this-&gt;autoCreateGetProducts())
            return null;
        if (!is_array($products))
            $products = array($products);

        $userTable = $this-&gt;getPlugin()-&gt;getDi()-&gt;userTable;
        
        $userInfo = $this-&gt;fetchUserInfo();
        $externalId = $this-&gt;generateUserExternalId($userInfo);
        
        $user = null;
        if ($externalId)
            $user = $userTable-&gt;findFirstByData(&#039;external_id&#039;, $externalId);
        if (!$user) 
        {
            $user = $userTable-&gt;findFirstByEmail($userInfo[&#039;email&#039;]);
            if ($user)
                $user-&gt;data()-&gt;set(&#039;external_id&#039;, $externalId)-&gt;update();
        }
        if (!$user)
        {
            $user = $userTable-&gt;createRecord($userInfo);
            $user-&gt;generateLogin();
            $user-&gt;generatePassword();
            $user-&gt;data()-&gt;set(&#039;external_id&#039;, $externalId);
            $user-&gt;insert();
            if ($this-&gt;getPlugin()-&gt;getDi()-&gt;config-&gt;get(&#039;registration_mail&#039;))
                $user-&gt;sendRegistrationEmail();
        }
        
        //
        
        if ($invoice)
        {
            if ($invoice-&gt;user_id != $user-&gt;user_id) 
            {   
                $invoice = null; // strange!!!
            } else {
                $invoice-&gt;_autoCreated = true;
            }
        }
        /// 
        if (!$invoice)
        {
            $invoice = $this-&gt;getPlugin()-&gt;getDi()-&gt;invoiceRecord;
            $invoice-&gt;setUser($user);
            foreach ($products as $pr)
                $invoice-&gt;add($pr);
            $invoice-&gt;calculate();
            $invoice-&gt;data()-&gt;set(&#039;external_id&#039;, $invoiceExternalId);
            $invoice-&gt;paysys_id = $this-&gt;plugin-&gt;getId();
            $invoice-&gt;insert();
            $invoice-&gt;_autoCreated = true;
        }
        return $invoice;
    }
    
    /** 
     * find matching products according to request
     * @return array&lt;Product&gt;
     */
    function autoCreateGetProducts()
    {
        throw new Am_Exception_NotImplemented(&quot;autoCreateGetProducts not implemented&quot;);
    }
    /**
     * Find out user info from transaction details
     * @see $_autoCreateMap
     * @return array
     */
    function fetchUserInfo()
    {
        if (!$this-&gt;_autoCreateMap)
            throw new Am_Exception_NotImplemented(&quot;fetchUserInfo not implemented&quot;);
        $ret = array();
        foreach ($this-&gt;_autoCreateMap as $field =&gt; $valKey)
            switch ($field)
            {
                case &#039;user_external_id&#039;: 
                case &#039;invoice_external_id&#039;:
                    break;
                case &#039;name&#039;:
                    @list($ret[&#039;name_f&#039;], $ret[&#039;name_l&#039;]) = preg_split(&#039;/\s+/&#039;, $this-&gt;request-&gt;get($valKey), 2);
                    break;
                default:
                    $ret[$field] = $this-&gt;request-&gt;get($valKey);
            }
        return $ret;
    }
    function fillInUserFields(User $user)
    {
        $info = $this-&gt;fetchUserInfo();
        if (!$info) return;
        $updated = 0;
        foreach ($info as $k =&gt; $v)
        {
            if (&#039;&#039;==$user-&gt;get($k))
            {
                $user-&gt;set($k, $v);
                $updated++;
            }
        }
        if ($updated)
            $user-&gt;update();
    }
    /**
     * @see $_autoCreateMap
     * @return string unique id of user - so user will not be re-generated even if he changes email
     */
    function generateUserExternalId(array $userInfo)
    {
        $field = @$this-&gt;_autoCreateMap[&#039;user_external_id&#039;];
        if (!empty($field))
            return $this-&gt;request-&gt;getFiltered($field);
        if (!empty($userInfo[&#039;email&#039;]))
            return md5($userInfo[&#039;email&#039;]);
        throw new Am_Exception_Paysystem_TransactionInvalid(&quot;Could not generate externalId&quot;);
    }
    /**
     * Must return the same value for single rebill sequence
     * @see $_autoCreateMap
     * @return string unique id of invoice - so rebills can be added to the same invoice
     */
    function generateInvoiceExternalId()
    {
        $field = @$this-&gt;_autoCreateMap[&#039;invoice_external_id&#039;];
        if (!empty($field)){
            if(is_array($field))
            {
                foreach($field as $v) if($res = $this-&gt;request-&gt;getFiltered($v)) return $res;
            }
            return $this-&gt;request-&gt;getFiltered($field);
        }
        throw new Am_Exception_Paysystem_NotImplemented(&quot;Not Implemented&quot;);
    }
    
    function resendPostback()
    {
        if ($this-&gt;plugin-&gt;getConfig(&#039;resend_postback&#039;))
        {
            $urls = $this-&gt;plugin-&gt;getConfig(&#039;resend_postback_urls&#039;);
            $urls = explode(&quot;\n&quot;, $urls);
            $urls = array_filter(array_map(&#039;trim&#039;, $urls));
            foreach ($urls as $url)
                try {
                    $tm = microtime(true);
                    $this-&gt;log-&gt;add(&quot;Resending postback to [$url]&quot;);
                    if ($url == $this-&gt;plugin-&gt;getPluginUrl(&#039;ipn&#039;))
                    {
                        throw new Am_Exception_Configuration(&quot;DO NOT CONFIGURE RESENDING IPN TO ITSELF!&quot;);
                    }
                    $req = new Am_HttpRequest($url);
                    $req-&gt;setConfig(&#039;connect_timeout&#039;, 1000);
                    $req-&gt;setConfig(&#039;timeout&#039;, 2000);
                    $method = strtoupper($this-&gt;request-&gt;getMethod());
                    $req-&gt;setMethod($method);
                    if ($method == &#039;POST&#039;) 
                    {
                        foreach ($this-&gt;request-&gt;getPost() as $k =&gt; $v)
                            $req-&gt;addPostParameter($k, $v);
                    } else {
                        $arr = $this-&gt;request-&gt;getQuery();
                        $req-&gt;setUrl($req-&gt;getUrl() . &#039;?&#039; . http_build_query($arr));
                    }
                    $req-&gt;send();
                    $tm = sprintf(&#039;%.3f&#039;, microtime(true) - $tm);
                    $this-&gt;log-&gt;add(&quot;Postback resent successfully ($tm sec)&quot;);
                } catch (Exception $e) {
                    $tm = sprintf(&#039;%.3f&#039;, microtime(true) - $tm);
                    $this-&gt;log-&gt;add(&quot;Cannot resend postback ($tm sec)&quot;);
                    $this-&gt;log-&gt;add($e);
                }
        }
    }
    
    function process()
    {
        // resend postback first as exception may be raised below
        $this-&gt;resendPostback();
        parent::process();
        // all went OK, with no exceptions, lets try to update customer info
        if (!empty($this-&gt;invoice-&gt;_autoCreated) &amp;&amp; ($user = $this-&gt;invoice-&gt;getUser()))
            $this-&gt;fillInUserFields($user);
    }
    
    /** @return Invoice|null */
    public function loadInvoice($invoiceId)
    {
        $invoiceId = preg_replace(&#039;/-.*/&#039;, &#039;&#039;, $invoiceId);
        $invoice = Am_Di::getInstance()-&gt;invoiceTable-&gt;findFirstByPublicId($invoiceId);
        // update invoice_id in the log record
        if ($invoice &amp;&amp; $this-&gt;log)
        {
            $this-&gt;log-&gt;updateQuick(array(
                &#039;invoice_id&#039; =&gt; $invoice-&gt;pk(),
                &#039;user_id&#039; =&gt; $invoice-&gt;user_id,
            ));
        }
        return $invoice;
    }
    
    protected function autoCreate()
    {
        try {
            $invoiceId = $this-&gt;findInvoiceId();
            if ($invoiceId === null)
                throw new Am_Exception_Paysystem_TransactionEmpty(&quot;Looks like an invalid IPN post - no Invoice# passed&quot;);
            $invoiceId = filterId($invoiceId);
            if (!strlen($invoiceId))
                throw new Am_Exception_Paysystem_TransactionInvalid(&quot;Could not load Invoice related to this transaction, passed id is not a valid Invoice#[$invoiceId]&quot;);
            if (!$this-&gt;invoice = $this-&gt;loadInvoice($invoiceId))
                throw new Am_Exception_Paysystem_TransactionUnknown(&quot;Unknown transaction: related invoice not found #[$invoiceId]&quot;);
        } catch (Am_Exception_Paysystem $e) {
            if (!$this-&gt;plugin-&gt;getConfig(&#039;auto_create&#039;)) 
                throw $e;
            // try auto-create invoice
            $invoice = $this-&gt;autoCreateInvoice();
            if ($invoice) 
                $this-&gt;invoice = $invoice;
            else
                throw $e;
        }
        $this-&gt;time = $this-&gt;findTime();
    }

    /**
     * Validates if transaction comes from trusted source,
     * and if it matches found invoice
     * @throws Am_Exception_Paysystem
     * @return null must throw exception if it is not OK
     */
    public function validate()
    {
        if (!$this-&gt;validateSource())
            throw new Am_Exception_Paysystem_TransactionSource(&quot;IPN seems to be received from unknown source, not from the paysystem&quot;);
        $this-&gt;autoCreate();
        if (empty($this-&gt;invoice-&gt;_autoCreated) &amp;&amp; !$this-&gt;validateTerms())
            throw new Am_Exception_Paysystem_TransactionInvalid(&quot;Subscriptions terms in the IPN does not match subscription terms in our Invoice&quot;);
        if (!$this-&gt;validateStatus())
            throw new Am_Exception_Paysystem_TransactionInvalid(&quot;Payment status is invalid, this IPN is not regarding a completed payment&quot;);
    }

    /**
     * Make sure transaction is coming from the payment system and not from the fraudient source
     * @return true if OK, false if not
     */
    abstract public function validateSource();

    /**
     * Make sure the transaction have the same terms (at least paid amount as the @see $invoice )
     * NOTE: if invoice is auto-created, its terms will NOT be validated
     * @return true if OK, false if not
     */
    abstract public function validateTerms();

    /**
     * Make sure this transaction is not regarding a pending or failed payment
     * @return true if OK, false if not
     */
    abstract public function validateStatus();

    /**
     * Find Invoice related with the current post as passed to the paysystem
     * must return null if no invoice_id present in the post
     * @return int|null id of invoice, null if not found
     */
    public function findInvoiceId()
    {
        throw new Am_Exception_NotImplemented(&quot;findInvoiceId is not implemented&quot;);
    }

    /**
     * Compare request IP with configured in plugin
     * and raise exception if that is wrong
     * @param mixed $ip string will be parsed using this format: $ip1_start [- $ip1_end][\n$ip2_start [- $ip2_end]] etc... 
     * Array should have this format: array( array(&#039;start1&#039;, &#039;stop1&#039;), single_ip, array(&#039;start2&#039;, &#039;stop2&#039;))
     * also it may automatically check for hostname belonging to subdomain like
     * .worldpay.com
     */
    public function _checkIp($ip)
    {
        $got = $this-&gt;request-&gt;getClientIp(false);
        if(!is_array($ip))
        {
            $expected = array();
            foreach(split(&quot;\n&quot;, $ip) as $l){
                if(strpos($l, &quot;-&quot;)!== false){
                    list($k, $v) = split(&quot;-&quot;, $l);
                    $expected[] = array(trim($k),trim($v));
                }else{
                    $expected[] = trim($l);
                }
            }
        }else $expected = $ip;
        
        $expected = array_filter($expected);
        if(empty($expected))
            throw new Am_Exception_InputError(&quot;{$this-&gt;plugin-&gt;getId()} configuration error. Expected IP address array is empty!&quot;);
        
        $found =false;
        $hostname = null;
        foreach ($expected as $v)
        {
            if (is_array($v))
            {
                if(ip2long($got) &gt;= ip2long($v[0]) &amp;&amp; ip2long($got) &lt;= ip2long($v[1])) 
                {
                    $found = true;
                    break;
                }
            } else {
                if($got == $v) 
                {
                    $found = true;
                    break;
                }
                if ($v[0] == &#039;.&#039;)
                {
                    if (!$hostname) $hostname = gethostbyaddr($got);
                    if (preg_match($x=&#039;|&#039;.preg_quote($v).&#039;$|&#039;, $hostname))
                    {
                        $found = true;
                        break;
                    }
                }
            }
        }
        if (!$found)
            throw new Am_Exception_Paysystem_TransactionSource(&quot;{$this-&gt;plugin-&gt;getId()} post comes from unknown IP [$got]&quot;);
    }
    
    public function assertAmount($expected, $got, $whereMsg = &quot;amount&quot;)
    {
        if ($e=moneyRound($expected) != $g=moneyRound($got))
            throw new Am_Exception_Paysystem_TransactionInvalid(&quot;Transaction $whereMsg [$g] does not match expected [$e]&quot;);
    }

}</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2F4xpips.net%2Fsecure%2Flibrary%2FAm%2FPaysystem%2FTransaction'>⬅ Back to Directory</a>