IPN Verification Postback to HTTPS Microsite *Important Update Needed*

[pete2007]

Hello,

Does anyone know anything about the new PayPal changes for "IPN Verification Postback to HTTPS Microsite" ?
https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1916

Has anyone made this change? or know how it can be done?

Thank you in advance.

Merchants and partners use Instant Payment Notification (IPN) to receive notifications of events related to PayPal transactions. The IPN message service requires that you acknowledge receipt of these messages and validate them. This process includes posting the messages back to PayPal for verification. In the past, PayPal has allowed the use of HTTP for these postbacks. For increased security going forward, only HTTPS will be allowed for postbacks to PayPal. At this time, there is no requirement for HTTPS on the outbound IPN call from PayPal to the merchant’s IPN listener.

To avoid any disruption of service, you must verify that your systems are ready for this change by June 30, 2017

[Harald Ponce de Leon]

All PayPal modules we have included in our releases have always used HTTPS and POST. If you would like to make sure that your module works without disruption after June 30, you can check now by performing a test order and transaction using the PayPal sandbox server.

[pete2007]

Thank you very much for your reply.

[pete2007]

4 hours ago, Harald Ponce de Leon said:

All PayPal modules we have included in our releases have always used HTTPS and POST. If you would like to make sure that your module works without disruption after June 30, you can check now by performing a test order and transaction using the PayPal sandbox server.

Hi Harald,

Just to be sure, you are referring about the PayPal App?

The PayPal modules I have installed are:

• PayPal Express Checkout - Version: 3.0 (online status)  API Version: 112
• PayPal Payments Pro (Hosted Solution) - Version: 1.0 (online status) API Version: 112

Do you think these modules will be ok with PayPal after the 30th of June?

Thanks,

Pete

[pete2007]

I've spoken to PayPal technical support and they have said the following:

Quote

Hi Pete,
 
I've looked into the files for osCommerce (osCommerce made the module, not PayPal) and it appears they're using one URL for two purposes.
 
1. To submit payments to production environment for processing
 
2. To submit IPN data to production environment for validation
 
The problem here is that, you cannot just modify the URL and enter the newer "ipnpb.paypal.com" endpoint as this wouldn't work for submitting payments to production environment.  osCommerce would need to add another line of code for the IPN endpoint and point to this line of code within the payment modules.
 
For reference, the URL's are in the file "includes/modules/payment/paypal_standard.php" starting on line 37
 
        if ( MODULE_PAYMENT_PAYPAL_STANDARD_GATEWAY_SERVER == 'Live' ) {
          $this->form_action_url = 'https://www.paypal.com/cgi-bin/webscr';
        } else {
          $this->form_action_url = 'https://www.sandbox.paypal.com/cgi-bin/webscr';
 
 
Within the file /ext/modules/payment/paypal/standard_ipn.php they are pointing to the code above on line 34
 
$result = $paypal_standard->sendTransactionToGateway($paypal_standard->form_action_url, $parameters);
 
The "form_action_url" being read from the "paypal_standard.php" file above.
 
osCommerce should provide an updated version of the module to implement these changes.
 
Kind Regards
Justin
MTS

Please can someone confirm if the PayPal app will resolve this problem?

Thank you.