3 * This file is part of CiviCRM.
5 * CiviCRM is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 3 of the License, or
8 * (at your option) any later version.
10 * CiviCRM is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with CiviCRM. If not, see <http://www.gnu.org/licenses/>.
19 * Licensed to CiviCRM under the GPL v3 or higher
21 * Written and contributed by Ward Vandewege <ward@fsf.org> (http://www.fsf.org)
22 * Modified by Lisa Marie Maginnis <lisa@fsf.org> (http://www.fsf.org)
23 * Copyright © 2015 David Thompson <davet@gnu.org>
28 * CiviCRM payment processor module for TrustCommerece.
30 * This module uses the TrustCommerece API via the tc_link module (GPLv3)
31 * distributed by TrustCommerece.com. For full documentation on the
32 * TrustCommerece API, please see the TCDevGuide for more information:
33 * https://vault.trustcommerce.com/downloads/TCDevGuide.htm
35 * This module supports the following features: Single credit/debit card
36 * transactions, AVS checking, recurring (create, update, and cancel
37 * subscription) optional blacklist with fail2ban,
39 * @copyright Ward Vandewege <ward@fsf.org> (http://www.fsf.org)
40 * @copyright Lisa Marie Maginnis <lisa@fsf.org> (http://www.fsf.org)
41 * @copyright David Thompson <davet@gnu.org>
43 * @package org.fsf.payment.trustcommerce
47 * Define logging level (0 = off, 4 = log everything)
49 define('TRUSTCOMMERCE_LOGGING_LEVEL', 4);
52 * Load the CiviCRM core payment class so we can extend it.
54 require_once 'CRM/Core/Payment.php';
57 * The payment processor object, it extends CRM_Core_Payment.
59 //class org_fsf_payment_trustcommerce extends CRM_Core_Payment {
60 class CRM_Core_Payment_TrustCommerce
extends CRM_Core_Payment
{
66 * This is our default charset, currently unused.
68 CONST CHARSET
= 'iso-8859-1';
70 * The API response value for transaction approved.
72 CONST AUTH_APPROVED
= 'approve';
74 * The API response value for transaction declined.
76 CONST AUTH_DECLINED
= 'decline';
78 * The API response value for baddata passed to the TC API.
80 CONST AUTH_BADDATA
= 'baddata';
82 * The API response value for an error in the TC API call.
84 CONST AUTH_ERROR
= 'error';
86 * The API response value for blacklisted in our local blacklist
88 CONST AUTH_BLACKLIST
= 'blacklisted';
90 * The API response value for approved status per the TCDevGuide.
92 CONST AUTH_ACCEPTED
= 'accepted';
95 * The current mode of the payment processor, valid values are: live, demo.
99 protected $_mode = NULL;
101 * The array of params cooked and passed to the TC API via tc_link().
105 protected $_params = array();
108 * We only need one instance of this object. So we use the singleton
109 * pattern and cache the instance in this variable
113 static private $_singleton = NULL;
116 * Sets our basic TC API paramaters (username, password). Also sets up:
117 * logging level, processor name, the mode (live/demo), and creates/copies
120 * @param string $mode the mode of operation: live or test
121 * @param CRM_Core_Payment The payment processor object.
125 function __construct($mode, &$paymentProcessor) {
126 $this->_mode
= $mode;
128 $this->_paymentProcessor
= $paymentProcessor;
130 $this->_processorName
= ts('TrustCommerce');
132 $config = CRM_Core_Config
::singleton();
133 $this->_setParam('user_name', $paymentProcessor['user_name']);
134 $this->_setParam('password', $paymentProcessor['password']);
136 $this->_setParam('timestamp', time());
138 $this->_setParam('sequence', rand(1, 1000));
139 $this->logging_level
= TRUSTCOMMERCE_LOGGING_LEVEL
;
144 * The singleton function used to manage this object
146 * @param string $mode the mode of operation: live or test
147 * @param CRM_Core_Payment The payment processor object.
152 static function &singleton($mode, &$paymentProcessor) {
153 $processorName = $paymentProcessor['name'];
154 if (self
::$_singleton[$processorName] === NULL) {
155 self
::$_singleton[$processorName] = new CRM_Core_Payment_TrustCommerce($mode, $paymentProcessor);
157 return self
::$_singleton[$processorName];
161 * Submit a payment using the TC API
163 * @param array $params The params we will be sending to tclink_send()
164 * @return mixed An array of our results, or an error object if the transaction fails.
167 function doDirectPayment(&$params) {
168 if (!extension_loaded("tclink")) {
169 return self
::error(9001, 'TrustCommerce requires that the tclink module is loaded');
172 /* Copy our paramaters to ourself */
173 foreach ($params as $field => $value) {
174 $this->_setParam($field, $value);
177 /* Get our fields to pass to tclink_send() */
178 $tc_params = $this->_getTrustCommerceFields();
180 /* Are we recurring? If so add the extra API fields. */
181 if (CRM_Utils_Array
::value('is_recur', $params) == 1) {
182 $tc_params = $this->_getRecurPaymentFields($tc_params);
186 /* Pass our cooked params to the alter hook, per Core/Payment/Dummy.php */
187 CRM_Utils_Hook
::alterPaymentProcessorParams($this, $params, $tc_params);
189 // TrustCommerce will not refuse duplicates, so we should check if the user already submitted this transaction
190 if ($this->_checkDupe($tc_params['ticket'])) {
191 return self
::error(9004, 'It appears that this transaction is a duplicate. Have you already submitted the form once? If so there may have been a connection problem. You can try your transaction again. If you continue to have problems please contact the site administrator.');
194 /* This implements a local blacklist, and passes us though as a normal failure
195 * if the luser is on the blacklist. */
196 if(!$this->_isBlacklisted($tc_params)) {
197 /* Call the TC API, and grab the reply */
198 $reply = $this->_sendTCRequest($tc_params);
200 $this->_logger($tc_params);
201 $reply['status'] = self
::AUTH_BLACKLIST
;
202 usleep(rand(1000000,10000000));
205 /* Parse our reply */
206 $result = $this->_getTCReply($reply);
208 if(!is_object($result)) {
210 /* We were successful, congrats. Lets wrap it up:
211 * Convert back to dollars
212 * Save the transaction ID
215 if (array_key_exists('billingid', $reply)) {
216 $params['recurr_profile_id'] = $reply['billingid'];
217 CRM_Core_DAO
::setFieldValue(
218 'CRM_Contribute_DAO_ContributionRecur',
219 $this->_getParam('contributionRecurID'),
220 'processor_id', $reply['billingid']
223 $params['trxn_id'] = $reply['transid'];
225 $params['gross_amount'] = $tc_params['amount'] / 100;
230 /* Otherwise we return the error object */
236 * Hook to update CC info for a recurring contribution
238 * @param string $message The message to dispaly on update success/failure
239 * @param array $params The paramters to pass to the payment processor
241 * @return bool True if successful, false on failure
243 function updateSubscriptionBillingInfo(&$message = '', $params = array()) {
244 $expYear = $params['credit_card_exp_date']['Y'];
245 $expMonth = $params['credit_card_exp_date']['M'];
247 // TODO: This should be our build in params set function, not by hand!
249 'custid' => $this->_paymentProcessor
['user_name'],
250 'password' => $this->_paymentProcessor
['password'],
252 'billingid' => $params['subscriptionId'],
253 'avs' => 'y', // Enable address verification
254 'address1' => $params['street_address'],
255 'zip' => $params['postal_code'],
256 'name' => $this->_formatBillingName($params['first_name'],
257 $params['last_name']),
258 'cc' => $params['credit_card_number'],
259 'cvv' => $params['cvv2'],
260 'exp' => $this->_formatExpirationDate($expYear, $expMonth),
261 'amount' => $this->_formatAmount($params['amount']),
264 CRM_Utils_Hook
::alterPaymentProcessorParams($this, $params, $tc_params);
266 $reply = $this->_sendTCRequest($tc_params);
267 $result = $this->_getTCReply($reply);
270 // TODO: Respect vaules for $messages passed in from our caller
271 $message = 'Successfully updated TC billing id ' . $tc_params['billingid'];
279 // TODO: Use the formatting functions throughout the entire class to
280 // dedupe the conversions done elsewhere in a less reusable way.
283 * Internal routine to convert from CiviCRM amounts to TC amounts.
285 * Multiplies the amount by 100.
287 * @param float $amount The currency value to convert.
289 * @return int The TC amount
291 private function _formatAmount($amount) {
292 return $amount * 100;
296 * Internal routine to format the billing name for TC
298 * @param string $firstName The first name to submit to TC
299 * @param string $lastName The last name to submit to TC
301 * @return string The TC name format, "$firstName $lastName"
303 private function _formatBillingName($firstName, $lastName) {
304 return "$firstName $lastName";
308 * Formats the expiration date for TC
310 * @param int $year The credit card expiration year
311 * @param int $month The credit card expiration year
313 * @return The TC CC expiration date format, "$month$year"
315 private function _formatExpirationDate($year, $month) {
316 $exp_month = str_pad($month, 2, '0', STR_PAD_LEFT
);
317 $exp_year = substr($year, -2);
319 return "$exp_month$exp_year";
322 private function _isParamsBlacklisted($tc_params) {
323 // quidam 18/Jun/2020
324 // block brazil small donations
325 if(($tc_params['country'] == 'BR') && ($tc_params['amount'] < 2000)) {
326 error_log("TrustCommerce: _isParamsBlacklisted() triggered by BR country");
329 if($tc_params['address1'] == '230 Motley Dr') {
330 error_log("TrustCommerce: _isParamsBlacklisted() triggered by 230 Motley Dr address");
337 * Checks to see if the source IP/USERAGENT are blacklisted.
339 * @return bool TRUE if on the blacklist, FALSE if not.
341 private function _isBlacklisted($tc_params) {
342 if($this->_isIPBlacklisted()) {
344 } else if($this->_isAgentBlacklisted()) {
346 } else if($this->_isParamsBlacklisted($tc_params)) {
354 * Checks to see if the source USERAGENT is blacklisted
356 * @return bool TRUE if on the blacklist, FALSE if not.
358 private function _isAgentBlacklisted() {
359 // TODO: fix DB calls to be more the CiviCRM way
360 $ip = $_SERVER['REMOTE_ADDR'];
361 $agent = $_SERVER['HTTP_USER_AGENT'];
362 $dao = CRM_Core_DAO
::executeQuery('SELECT * FROM `trustcommerce_useragent_blacklist`');
363 while($dao->fetch()) {
364 if(preg_match('/'.$dao->name
.'/', $agent) === 1) {
365 error_log(' [client '.$ip.'] [agent '.$agent.'] - Blacklisted by USER_AGENT rule #'.$dao->id
);
373 * Checks to see if the source IP is blacklisted
375 * @return bool TRUE if on the blacklist, FALSE if not.
377 private function _isIPBlacklisted() {
378 // TODO: fix DB calls to be more the CiviCRM way
379 $ip = $_SERVER['REMOTE_ADDR'];
380 $agent = $_SERVER['HTTP_USER_AGENT'];
381 $blacklist = array();
382 $dao = CRM_Core_DAO
::executeQuery('SELECT * FROM `trustcommerce_blacklist`');
383 while($dao->fetch()) {
384 if($ip == $dao->ip
) {
385 error_log('[client '.$ip.'] [agent '.$agent.'] Blacklisted by IP rule #'.$dao->id
);
393 * Sends the API call to TC for processing
395 * @param array $request The array of paramaters to pass the TC API
397 * @return array The response from the TC API
399 function _sendTCRequest($request) {
400 $this->_logger($request);
401 return tclink_send($request);
405 * Logs paramaters from TC along with the remote address of the client
407 * Will log paramaters via the error_log() routine. For security reasons
408 * the following values are not logged (skipped): custid, password, cc
411 * @param array $params The paramaters to log
413 function _logger($params) {
415 foreach ($params as $key => $data) {
416 /* Delete any data we should not be writing to disk. This includes:
417 * custid, password, cc, exp, and cvv
427 $msg .= ' '.$key.' => '.$data;
430 error_log('[client '.$_SERVER['REMOTE_ADDR'].'] TrustCommerce:'.$msg);
434 * Gets the recurring billing fields for the TC API
436 * @param array $fields The fields to modify.
437 * @return array The fields for tclink_send(), modified for recurring billing.
440 function _getRecurPaymentFields($fields) {
441 $payments = $this->_getParam('frequency_interval');
442 $cycle = $this->_getParam('frequency_unit');
444 /* Translate billing cycle from CiviCRM -> TC */
460 /* Translate frequency interval from CiviCRM -> TC
461 * Payments are the same, HOWEVER a payment of 1 (forever) should be 0 in TC */
466 $fields['cycle'] = '1'.$cycle; /* The billing cycle in years, months, weeks, or days. */
467 $fields['payments'] = $payments;
468 $fields['action'] = 'store'; /* Change our mode to `store' mode. */
473 /** Parses a response from TC via the tclink_send() command.
475 * @param array $reply The result of a call to tclink_send().
477 * @return mixed|CRM_Core_Error CRM_Core_Error object if transaction failed, otherwise
480 function _getTCReply($reply) {
482 /* DUPLIATE CODE, please refactor. ~lisa */
484 return self
::error(9002, 'Could not initiate connection to payment gateway.');
487 $this->_logger($reply);
489 switch($reply['status']) {
490 case self
::AUTH_BLACKLIST
:
491 return self
::error(9009, "Your transaction was declined. Please check the correctness of your credit card information, including CC number, expiration date and CVV code. ");
493 case self
::AUTH_APPROVED
:
495 case self
::AUTH_ACCEPTED
:
498 case self
::AUTH_DECLINED
:
499 // TODO FIXME be more or less specific?
500 // declinetype can be: decline, avs, cvv, call, expiredcard, carderror, authexpired, fraud, blacklist, velocity
501 // See TC documentation for more info
502 switch($reply['declinetype']) {
504 return self
::error(9009, "Your transaction was declined for address verification reasons. If your address was correct please contact us at donate@fsf.org before attempting to retry your transaction.");
507 return self
::error(9009, "Your transaction was declined. Please check the correctness of your credit card information, including CC number, expiration date and CVV code.");
509 case self
::AUTH_BADDATA
:
510 // TODO FIXME do something with $reply['error'] and $reply['offender']
511 return self
::error(9011, "Invalid credit card information. The following fields were invalid: {$reply['offenders']}.");
513 case self
::AUTH_ERROR
:
514 return self
::error(9002, 'Could not initiate connection to payment gateway');
521 * Generate the basic paramaters to send the TC API
523 * @return array The array of paramaters to pass _sendTCRequest()
525 function _getTrustCommerceFields() {
526 // Total amount is from the form contribution field
527 $amount = $this->_getParam('total_amount');
528 // CRM-9894 would this ever be the case??
529 if (empty($amount)) {
530 $amount = $this->_getParam('amount');
534 $fields['custid'] = $this->_paymentProcessor
['user_name'];
535 $fields['password'] = $this->_paymentProcessor
['password'];
537 $fields['action'] = 'sale';
539 // Enable address verification
540 $fields['avs'] = 'y';
542 $fields['address1'] = $this->_getParam('street_address');
543 $fields['zip'] = $this->_getParam('postal_code');
544 $fields['country'] = $this->_getParam('country');
547 * Fix AVS problem when a non-US country, has address1 and zip both starting
550 if( ($fields['country'] !== '840' && $fields['country'] !== 840)
551 && (preg_match("/^\D/", $fields['zip']) === 1)
552 && (preg_match("/^\D/", $fields['address1']) === 1) ) {
553 // Add a number to the beginning of the address.
554 $fields['address1'] = preg_replace("/^/", "1 ", $fields['address1']);
557 $fields['name'] = $this->_getParam('billing_first_name') . ' ' . $this->_getParam('billing_last_name');
559 // This assumes currencies where the . is used as the decimal point, like USD
560 $amount = preg_replace("/([^0-9\\.])/i", "", $amount);
562 // We need to pass the amount to TrustCommerce in dollar cents
563 $fields['amount'] = $amount * 100;
566 $fields['ticket'] = substr($this->_getParam('invoiceID'), 0, 20);
569 $fields['cc'] = $this->_getParam('credit_card_number');
570 $fields['cvv'] = $this->_getParam('cvv2');
571 $exp_month = str_pad($this->_getParam('month'), 2, '0', STR_PAD_LEFT
);
572 $exp_year = substr($this->_getParam('year'),-2);
573 $fields['exp'] = "$exp_month$exp_year";
575 if ($this->_mode
!= 'live') {
576 $fields['demo'] = 'y';
582 * Checks to see if invoice_id already exists in db
584 * @param int $invoiceId The ID to check
586 * @return bool True if ID exists, else false
588 function _checkDupe($invoiceId) {
589 require_once 'CRM/Contribute/DAO/Contribution.php';
590 $contribution = new CRM_Contribute_DAO_Contribution();
591 $contribution->invoice_id
= $invoiceId;
592 return $contribution->find();
596 * Get the value of a field if set
598 * @param string $field the field
600 * @return mixed value of the field, or empty string if the field is
603 function _getParam($field) {
604 $value = CRM_Utils_Array
::value($field, $this->_params
, '');
606 $value = str_replace(array('&', '"', "'", '<', '>'), '', $value);
612 * Sets our error message/logging information for CiviCRM
614 * @param int $errorCode The numerical code of the error, defaults to 9001
615 * @param string $errorMessage The error message to display/log
617 * @return CRM_Core_Error The error object with message and code.
619 function &error($errorCode = NULL, $errorMessage = NULL) {
620 $e = CRM_Core_Error
::singleton();
622 $e->push($errorCode, 0, NULL, $errorMessage);
625 $e->push(9001, 0, NULL, 'Unknown System Error.');
631 * Set a field to the specified value. Value must be a scalar (int,
632 * float, string, or boolean)
634 * @param string $field
635 * @param mixed $value
637 * @return bool false if value is not a scalar, true if successful
639 function _setParam($field, $value) {
640 if (!is_scalar($value)) {
644 $this->_params
[$field] = $value;
649 * Checks to see if we have the manditory config values set.
651 * @return string the error message if any
654 function checkConfig() {
656 if (empty($this->_paymentProcessor
['user_name'])) {
657 $error[] = ts('Customer ID is not set for this payment processor');
660 if (empty($this->_paymentProcessor
['password'])) {
661 $error[] = ts('Password is not set for this payment processor');
664 if (!empty($error)) {
665 return implode('<p>', $error);
672 * Hook to cancel a recurring contribution
674 * @param string $message The message to dispaly on update success/failure
675 * @param array $params The paramters to pass to the payment processor
677 * @return bool True if successful, false on failure
679 function cancelSubscription(&$message = '', $params = array()) {
680 $tc_params['custid'] = $this->_getParam('user_name');
681 $tc_params['password'] = $this->_getParam('password');
682 $tc_params['action'] = 'unstore';
683 $tc_params['billingid'] = CRM_Utils_Array
::value('subscriptionId', $params);
685 $result = $this->_sendTCRequest($tc_params);
687 /* Test if call failed */
689 return self
::error(9002, 'Could not initiate connection to payment gateway');
691 /* We are done, pass success */
696 * Hook to update amount billed for a recurring contribution
698 * @param string $message The message to dispaly on update success/failure
699 * @param array $params The paramters to pass to the payment processor
701 * @return bool True if successful, false on failure
703 function changeSubscriptionAmount(&$message = '', $params = array()) {
704 $tc_params['custid'] = $this->_paymentProcessor
['user_name'];
705 $tc_params['password'] = $this->_paymentProcessor
['password'];
706 $tc_params['action'] = 'store';
708 $tc_params['billingid'] = CRM_Utils_Array
::value('subscriptionId', $params);
709 $tc_params['payments'] = CRM_Utils_Array
::value('installments', $params);
710 $tc_params['amount'] = CRM_Utils_Array
::value('amount', $params) * 100;
712 if($tc_params['payments'] == 1) {
713 $tc_params['payments'] = 0;
715 $reply = $this->_sendTCRequest($tc_params);
716 $result = $this->_getTCReply($reply);
718 /* We are done, pass success */
724 * Installs the trustcommerce module (currently a dummy)
726 public function install() {
731 * Uninstalls the trustcommerce module (currently a dummy)
733 public function uninstall() {