64a7545dc2a537a118b779f3808c6cbe0bbd6ecb
[trustcommerce.git] / CRM / Core / Payment / TrustCommerce.php
1 <?php
2 /*
3 * This file is part of CiviCRM.
4 *
5 * CiviCRM is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 3 of the License, or
8 * (at your option) any later version.
9 *
10 * CiviCRM is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with CiviCRM. If not, see <http://www.gnu.org/licenses/>.
17 *
18 * Copyright (C) 2012
19 * Licensed to CiviCRM under the GPL v3 or higher
20 *
21 * Written and contributed by Ward Vandewege <ward@fsf.org> (http://www.fsf.org)
22 * Modified by Lisa Marie Maginnis <lisa@fsf.org> (http://www.fsf.org)
23 * Copyright © 2015 David Thompson <davet@gnu.org>
24 *
25 */
26
27 /**
28 * CiviCRM payment processor module for TrustCommerece.
29 *
30 * This module uses the TrustCommerece API via the tc_link module (GPLv3)
31 * distributed by TrustCommerece.com. For full documentation on the
32 * TrustCommerece API, please see the TCDevGuide for more information:
33 * https://vault.trustcommerce.com/downloads/TCDevGuide.htm
34 *
35 * This module supports the following features: Single credit/debit card
36 * transactions, AVS checking, recurring (create, update, and cancel
37 * subscription) optional blacklist with fail2ban,
38 *
39 * @copyright Ward Vandewege <ward@fsf.org> (http://www.fsf.org)
40 * @copyright Lisa Marie Maginnis <lisa@fsf.org> (http://www.fsf.org)
41 * @copyright David Thompson <davet@gnu.org>
42 * @version 0.4
43 * @package org.fsf.payment.trustcommerce
44 */
45
46 /**
47 * Define logging level (0 = off, 4 = log everything)
48 */
49 define('TRUSTCOMMERCE_LOGGING_LEVEL', 4);
50
51 /**
52 * Load the CiviCRM core payment class so we can extend it.
53 */
54 require_once 'CRM/Core/Payment.php';
55
56 /**
57 * The payment processor object, it extends CRM_Core_Payment.
58 */
59 //class org_fsf_payment_trustcommerce extends CRM_Core_Payment {
60 class CRM_Core_Payment_TrustCommerce extends CRM_Core_Payment {
61
62 /**#@+
63 * Constants
64 */
65 /**
66 * This is our default charset, currently unused.
67 */
68 CONST CHARSET = 'iso-8859-1';
69 /**
70 * The API response value for transaction approved.
71 */
72 CONST AUTH_APPROVED = 'approve';
73 /**
74 * The API response value for transaction declined.
75 */
76 CONST AUTH_DECLINED = 'decline';
77 /**
78 * The API response value for baddata passed to the TC API.
79 */
80 CONST AUTH_BADDATA = 'baddata';
81 /**
82 * The API response value for an error in the TC API call.
83 */
84 CONST AUTH_ERROR = 'error';
85 /**
86 * The API response value for blacklisted in our local blacklist
87 */
88 CONST AUTH_BLACKLIST = 'blacklisted';
89 /**
90 * The API response value for approved status per the TCDevGuide.
91 */
92 CONST AUTH_ACCEPTED = 'accepted';
93
94 /**
95 * The current mode of the payment processor, valid values are: live, demo.
96 * @static
97 * @var string
98 */
99 protected $_mode = NULL;
100 /**
101 * The array of params cooked and passed to the TC API via tc_link().
102 * @static
103 * @var array
104 */
105 protected $_params = array();
106
107 /**
108 * We only need one instance of this object. So we use the singleton
109 * pattern and cache the instance in this variable
110 * @static
111 * @var object
112 */
113 static private $_singleton = NULL;
114
115 /**
116 * Sets our basic TC API paramaters (username, password). Also sets up:
117 * logging level, processor name, the mode (live/demo), and creates/copies
118 * our singleton.
119 *
120 * @param string $mode the mode of operation: live or test
121 * @param CRM_Core_Payment The payment processor object.
122 *
123 * @return void
124 */
125 function __construct($mode, &$paymentProcessor) {
126 $this->_mode = $mode;
127
128 $this->_paymentProcessor = $paymentProcessor;
129
130 $this->_processorName = ts('TrustCommerce');
131
132 $config = CRM_Core_Config::singleton();
133 $this->_setParam('user_name', $paymentProcessor['user_name']);
134 $this->_setParam('password', $paymentProcessor['password']);
135
136 $this->_setParam('timestamp', time());
137 srand(time());
138 $this->_setParam('sequence', rand(1, 1000));
139 $this->logging_level = TRUSTCOMMERCE_LOGGING_LEVEL;
140
141 }
142
143 /**
144 * The singleton function used to manage this object
145 *
146 * @param string $mode the mode of operation: live or test
147 * @param CRM_Core_Payment The payment processor object.
148 *
149 * @return object
150 * @static
151 */
152 static function &singleton($mode, &$paymentProcessor) {
153 $processorName = $paymentProcessor['name'];
154 if (self::$_singleton[$processorName] === NULL) {
155 self::$_singleton[$processorName] = new CRM_Core_Payment_TrustCommerce($mode, $paymentProcessor);
156 }
157 return self::$_singleton[$processorName];
158 }
159
160 /**
161 * Submit a payment using the TC API
162 *
163 * @param array $params The params we will be sending to tclink_send()
164 * @return mixed An array of our results, or an error object if the transaction fails.
165 * @public
166 */
167 function doDirectPayment(&$params) {
168 if (!extension_loaded("tclink")) {
169 return self::error(9001, 'TrustCommerce requires that the tclink module is loaded');
170 }
171
172 /* Copy our paramaters to ourself */
173 foreach ($params as $field => $value) {
174 $this->_setParam($field, $value);
175 }
176
177 /* Get our fields to pass to tclink_send() */
178 $tc_params = $this->_getTrustCommerceFields();
179
180 /* Are we recurring? If so add the extra API fields. */
181 if (CRM_Utils_Array::value('is_recur', $params) == 1) {
182 $tc_params = $this->_getRecurPaymentFields($tc_params);
183 $recur=1;
184 }
185
186 /* Pass our cooked params to the alter hook, per Core/Payment/Dummy.php */
187 CRM_Utils_Hook::alterPaymentProcessorParams($this, $params, $tc_params);
188
189 // TrustCommerce will not refuse duplicates, so we should check if the user already submitted this transaction
190 if ($this->_checkDupe($tc_params['ticket'])) {
191 return self::error(9004, 'It appears that this transaction is a duplicate. Have you already submitted the form once? If so there may have been a connection problem. You can try your transaction again. If you continue to have problems please contact the site administrator.');
192 }
193
194 /* This implements a local blacklist, and passes us though as a normal failure
195 * if the luser is on the blacklist. */
196 if(!$this->_isBlacklisted($tc_params)) {
197 /* Call the TC API, and grab the reply */
198 $reply = $this->_sendTCRequest($tc_params);
199 } else {
200 $this->_logger($tc_params);
201 $reply['status'] = self::AUTH_BLACKLIST;
202 usleep(rand(1000000,10000000));
203 }
204
205 /* Parse our reply */
206 $result = $this->_getTCReply($reply);
207
208 if(!is_object($result)) {
209 if($result == 0) {
210 /* We were successful, congrats. Lets wrap it up:
211 * Convert back to dollars
212 * Save the transaction ID
213 */
214
215 if (array_key_exists('billingid', $reply)) {
216 $params['recurr_profile_id'] = $reply['billingid'];
217 CRM_Core_DAO::setFieldValue(
218 'CRM_Contribute_DAO_ContributionRecur',
219 $this->_getParam('contributionRecurID'),
220 'processor_id', $reply['billingid']
221 );
222 }
223 $params['trxn_id'] = $reply['transid'];
224
225 $params['gross_amount'] = $tc_params['amount'] / 100;
226
227 return $params;
228 }
229 } else {
230 /* Otherwise we return the error object */
231 return $result;
232 }
233 }
234
235 /**
236 * Hook to update CC info for a recurring contribution
237 *
238 * @param string $message The message to dispaly on update success/failure
239 * @param array $params The paramters to pass to the payment processor
240 *
241 * @return bool True if successful, false on failure
242 */
243 function updateSubscriptionBillingInfo(&$message = '', $params = array()) {
244 $expYear = $params['credit_card_exp_date']['Y'];
245 $expMonth = $params['credit_card_exp_date']['M'];
246
247 // TODO: This should be our build in params set function, not by hand!
248 $tc_params = array(
249 'custid' => $this->_paymentProcessor['user_name'],
250 'password' => $this->_paymentProcessor['password'],
251 'action' => 'store',
252 'billingid' => $params['subscriptionId'],
253 'avs' => 'y', // Enable address verification
254 'address1' => $params['street_address'],
255 'zip' => $params['postal_code'],
256 'name' => $this->_formatBillingName($params['first_name'],
257 $params['last_name']),
258 'cc' => $params['credit_card_number'],
259 'cvv' => $params['cvv2'],
260 'exp' => $this->_formatExpirationDate($expYear, $expMonth),
261 'amount' => $this->_formatAmount($params['amount']),
262 );
263
264 CRM_Utils_Hook::alterPaymentProcessorParams($this, $params, $tc_params);
265
266 $reply = $this->_sendTCRequest($tc_params);
267 $result = $this->_getTCReply($reply);
268
269 if($result === 0) {
270 // TODO: Respect vaules for $messages passed in from our caller
271 $message = 'Successfully updated TC billing id ' . $tc_params['billingid'];
272
273 return TRUE;
274 } else {
275 return FALSE;
276 }
277 }
278
279 // TODO: Use the formatting functions throughout the entire class to
280 // dedupe the conversions done elsewhere in a less reusable way.
281
282 /**
283 * Internal routine to convert from CiviCRM amounts to TC amounts.
284 *
285 * Multiplies the amount by 100.
286 *
287 * @param float $amount The currency value to convert.
288 *
289 * @return int The TC amount
290 */
291 private function _formatAmount($amount) {
292 return $amount * 100;
293 }
294
295 /**
296 * Internal routine to format the billing name for TC
297 *
298 * @param string $firstName The first name to submit to TC
299 * @param string $lastName The last name to submit to TC
300 *
301 * @return string The TC name format, "$firstName $lastName"
302 */
303 private function _formatBillingName($firstName, $lastName) {
304 return "$firstName $lastName";
305 }
306
307 /**
308 * Formats the expiration date for TC
309 *
310 * @param int $year The credit card expiration year
311 * @param int $month The credit card expiration year
312 *
313 * @return The TC CC expiration date format, "$month$year"
314 */
315 private function _formatExpirationDate($year, $month) {
316 $exp_month = str_pad($month, 2, '0', STR_PAD_LEFT);
317 $exp_year = substr($year, -2);
318
319 return "$exp_month$exp_year";
320 }
321
322 private function _isParamsBlacklisted($tc_params) {
323 if($tc_params['address1'] == '230 Motley Dr') {
324 error_log("TrustCommerce: _isParamsBlacklisted() triggered");
325 return TRUE;
326 }
327 return FALSE;
328 }
329
330 /**
331 * Checks to see if the source IP/USERAGENT are blacklisted.
332 *
333 * @return bool TRUE if on the blacklist, FALSE if not.
334 */
335 private function _isBlacklisted($tc_params) {
336 if($this->_isIPBlacklisted()) {
337 return TRUE;
338 } else if($this->_isAgentBlacklisted()) {
339 return TRUE;
340 } else if($this->_isParamsBlacklisted($tc_params)) {
341 return TRUE;
342 }
343 return FALSE;
344
345 }
346
347 /**
348 * Checks to see if the source USERAGENT is blacklisted
349 *
350 * @return bool TRUE if on the blacklist, FALSE if not.
351 */
352 private function _isAgentBlacklisted() {
353 // TODO: fix DB calls to be more the CiviCRM way
354 $ip = $_SERVER['REMOTE_ADDR'];
355 $agent = $_SERVER['HTTP_USER_AGENT'];
356 $dao = CRM_Core_DAO::executeQuery('SELECT * FROM `trustcommerce_useragent_blacklist`');
357 while($dao->fetch()) {
358 if(preg_match('/'.$dao->name.'/', $agent) === 1) {
359 error_log(' [client '.$ip.'] [agent '.$agent.'] - Blacklisted by USER_AGENT rule #'.$dao->id);
360 return TRUE;
361 }
362 }
363 return FALSE;
364 }
365
366 /**
367 * Checks to see if the source IP is blacklisted
368 *
369 * @return bool TRUE if on the blacklist, FALSE if not.
370 */
371 private function _isIPBlacklisted() {
372 // TODO: fix DB calls to be more the CiviCRM way
373 $ip = $_SERVER['REMOTE_ADDR'];
374 $agent = $_SERVER['HTTP_USER_AGENT'];
375 # Disable on IPv6
376 if ( strpos(":", $ip) !== false ){
377 return TRUE;
378 }
379 $ip = ip2long($ip);
380 $blacklist = array();
381 $dao = CRM_Core_DAO::executeQuery('SELECT * FROM `trustcommerce_blacklist`');
382 while($dao->fetch()) {
383 if($ip >= $dao->start && $ip <= $dao->end) {
384 error_log('[client '.long2ip($ip).'] [agent '.$agent.'] Blacklisted by IP rule #'.$dao->id);
385 return TRUE;
386 }
387 }
388 return FALSE;
389 }
390
391 /**
392 * Sends the API call to TC for processing
393 *
394 * @param array $request The array of paramaters to pass the TC API
395 *
396 * @return array The response from the TC API
397 */
398 function _sendTCRequest($request) {
399 $this->_logger($request);
400 return tclink_send($request);
401 }
402
403 /**
404 * Logs paramaters from TC along with the remote address of the client
405 *
406 * Will log paramaters via the error_log() routine. For security reasons
407 * the following values are not logged (skipped): custid, password, cc
408 * exp, and cvv.
409 *
410 * @param array $params The paramaters to log
411 */
412 function _logger($params) {
413 $msg = '';
414 foreach ($params as $key => $data) {
415 /* Delete any data we should not be writing to disk. This includes:
416 * custid, password, cc, exp, and cvv
417 */
418 switch($key) {
419 case 'custid':
420 case 'password':
421 case 'cc':
422 case 'exp':
423 case 'cvv':
424 break;
425 default:
426 $msg .= ' '.$key.' => '.$data;
427 }
428 }
429 error_log('[client '.$_SERVER['REMOTE_ADDR'].'] TrustCommerce:'.$msg);
430 }
431
432 /**
433 * Gets the recurring billing fields for the TC API
434 *
435 * @param array $fields The fields to modify.
436 * @return array The fields for tclink_send(), modified for recurring billing.
437 * @public
438 */
439 function _getRecurPaymentFields($fields) {
440 $payments = $this->_getParam('frequency_interval');
441 $cycle = $this->_getParam('frequency_unit');
442
443 /* Translate billing cycle from CiviCRM -> TC */
444 switch($cycle) {
445 case 'day':
446 $cycle = 'd';
447 break;
448 case 'week':
449 $cycle = 'w';
450 break;
451 case 'month':
452 $cycle = 'm';
453 break;
454 case 'year':
455 $cycle = 'y';
456 break;
457 }
458
459 /* Translate frequency interval from CiviCRM -> TC
460 * Payments are the same, HOWEVER a payment of 1 (forever) should be 0 in TC */
461 if($payments == 1) {
462 $payments = 0;
463 }
464
465 $fields['cycle'] = '1'.$cycle; /* The billing cycle in years, months, weeks, or days. */
466 $fields['payments'] = $payments;
467 $fields['action'] = 'store'; /* Change our mode to `store' mode. */
468
469 return $fields;
470 }
471
472 /** Parses a response from TC via the tclink_send() command.
473 *
474 * @param array $reply The result of a call to tclink_send().
475 *
476 * @return mixed|CRM_Core_Error CRM_Core_Error object if transaction failed, otherwise
477 * returns 0.
478 */
479 function _getTCReply($reply) {
480
481 /* DUPLIATE CODE, please refactor. ~lisa */
482 if (!$reply) {
483 return self::error(9002, 'Could not initiate connection to payment gateway.');
484 }
485
486 $this->_logger($reply);
487
488 switch($reply['status']) {
489 case self::AUTH_BLACKLIST:
490 return self::error(9001, "Your transaction was declined for address verification reasons. If your address was correct please contact us at donate@fsf.org before attempting to retry your transaction.");
491 break;
492 case self::AUTH_APPROVED:
493 break;
494 case self::AUTH_ACCEPTED:
495 // It's all good
496 break;
497 case self::AUTH_DECLINED:
498 // TODO FIXME be more or less specific?
499 // declinetype can be: decline, avs, cvv, call, expiredcard, carderror, authexpired, fraud, blacklist, velocity
500 // See TC documentation for more info
501 switch($reply['declinetype']) {
502 case 'avs':
503 return self::error(9009, "Your transaction was declined for address verification reasons. If your address was correct please contact us at donate@fsf.org before attempting to retry your transaction.");
504 break;
505 }
506 return self::error(9009, "Your transaction was declined. Please check the correctness of your credit card information, including CC number, expiration date and CVV code.");
507 break;
508 case self::AUTH_BADDATA:
509 // TODO FIXME do something with $reply['error'] and $reply['offender']
510 return self::error(9011, "Invalid credit card information. The following fields were invalid: {$reply['offenders']}.");
511 break;
512 case self::AUTH_ERROR:
513 return self::error(9002, 'Could not initiate connection to payment gateway');
514 break;
515 }
516 return 0;
517 }
518
519 /**
520 * Generate the basic paramaters to send the TC API
521 *
522 * @return array The array of paramaters to pass _sendTCRequest()
523 */
524 function _getTrustCommerceFields() {
525 // Total amount is from the form contribution field
526 $amount = $this->_getParam('total_amount');
527 // CRM-9894 would this ever be the case??
528 if (empty($amount)) {
529 $amount = $this->_getParam('amount');
530 }
531 $fields = array();
532
533 $fields['custid'] = $this->_paymentProcessor['user_name'];
534 $fields['password'] = $this->_paymentProcessor['password'];
535
536 $fields['action'] = 'sale';
537
538 // Enable address verification
539 $fields['avs'] = 'y';
540
541 $fields['address1'] = $this->_getParam('street_address');
542 $fields['zip'] = $this->_getParam('postal_code');
543 $fields['country'] = $this->_getParam('country');
544
545 $fields['name'] = $this->_getParam('billing_first_name') . ' ' . $this->_getParam('billing_last_name');
546
547 // This assumes currencies where the . is used as the decimal point, like USD
548 $amount = preg_replace("/([^0-9\\.])/i", "", $amount);
549
550 // We need to pass the amount to TrustCommerce in dollar cents
551 $fields['amount'] = $amount * 100;
552
553 // Unique identifier
554 $fields['ticket'] = substr($this->_getParam('invoiceID'), 0, 20);
555
556 // cc info
557 $fields['cc'] = $this->_getParam('credit_card_number');
558 $fields['cvv'] = $this->_getParam('cvv2');
559 $exp_month = str_pad($this->_getParam('month'), 2, '0', STR_PAD_LEFT);
560 $exp_year = substr($this->_getParam('year'),-2);
561 $fields['exp'] = "$exp_month$exp_year";
562
563 if ($this->_mode != 'live') {
564 $fields['demo'] = 'y';
565 }
566 return $fields;
567 }
568
569 /**
570 * Checks to see if invoice_id already exists in db
571 *
572 * @param int $invoiceId The ID to check
573 *
574 * @return bool True if ID exists, else false
575 */
576 function _checkDupe($invoiceId) {
577 require_once 'CRM/Contribute/DAO/Contribution.php';
578 $contribution = new CRM_Contribute_DAO_Contribution();
579 $contribution->invoice_id = $invoiceId;
580 return $contribution->find();
581 }
582
583 /**
584 * Get the value of a field if set
585 *
586 * @param string $field the field
587 *
588 * @return mixed value of the field, or empty string if the field is
589 * not set
590 */
591 function _getParam($field) {
592 $value = CRM_Utils_Array::value($field, $this->_params, '');
593 if ($xmlSafe) {
594 $value = str_replace(array('&', '"', "'", '<', '>'), '', $value);
595 }
596 return $value;
597 }
598
599 /**
600 * Sets our error message/logging information for CiviCRM
601 *
602 * @param int $errorCode The numerical code of the error, defaults to 9001
603 * @param string $errorMessage The error message to display/log
604 *
605 * @return CRM_Core_Error The error object with message and code.
606 */
607 function &error($errorCode = NULL, $errorMessage = NULL) {
608 $e = CRM_Core_Error::singleton();
609 if ($errorCode) {
610 $e->push($errorCode, 0, NULL, $errorMessage);
611 }
612 else {
613 $e->push(9001, 0, NULL, 'Unknown System Error.');
614 }
615 return $e;
616 }
617
618 /**
619 * Set a field to the specified value. Value must be a scalar (int,
620 * float, string, or boolean)
621 *
622 * @param string $field
623 * @param mixed $value
624 *
625 * @return bool false if value is not a scalar, true if successful
626 */
627 function _setParam($field, $value) {
628 if (!is_scalar($value)) {
629 return FALSE;
630 }
631 else {
632 $this->_params[$field] = $value;
633 }
634 }
635
636 /**
637 * Checks to see if we have the manditory config values set.
638 *
639 * @return string the error message if any
640 * @public
641 */
642 function checkConfig() {
643 $error = array();
644 if (empty($this->_paymentProcessor['user_name'])) {
645 $error[] = ts('Customer ID is not set for this payment processor');
646 }
647
648 if (empty($this->_paymentProcessor['password'])) {
649 $error[] = ts('Password is not set for this payment processor');
650 }
651
652 if (!empty($error)) {
653 return implode('<p>', $error);
654 } else {
655 return NULL;
656 }
657 }
658
659 /**
660 * Hook to cancel a recurring contribution
661 *
662 * @param string $message The message to dispaly on update success/failure
663 * @param array $params The paramters to pass to the payment processor
664 *
665 * @return bool True if successful, false on failure
666 */
667 function cancelSubscription(&$message = '', $params = array()) {
668 $tc_params['custid'] = $this->_getParam('user_name');
669 $tc_params['password'] = $this->_getParam('password');
670 $tc_params['action'] = 'unstore';
671 $tc_params['billingid'] = CRM_Utils_Array::value('subscriptionId', $params);
672
673 $result = $this->_sendTCRequest($tc_params);
674
675 /* Test if call failed */
676 if(!$result) {
677 return self::error(9002, 'Could not initiate connection to payment gateway');
678 }
679 /* We are done, pass success */
680 return TRUE;
681 }
682
683 /**
684 * Hook to update amount billed for a recurring contribution
685 *
686 * @param string $message The message to dispaly on update success/failure
687 * @param array $params The paramters to pass to the payment processor
688 *
689 * @return bool True if successful, false on failure
690 */
691 function changeSubscriptionAmount(&$message = '', $params = array()) {
692 $tc_params['custid'] = $this->_paymentProcessor['user_name'];
693 $tc_params['password'] = $this->_paymentProcessor['password'];
694 $tc_params['action'] = 'store';
695
696 $tc_params['billingid'] = CRM_Utils_Array::value('subscriptionId', $params);
697 $tc_params['payments'] = CRM_Utils_Array::value('installments', $params);
698 $tc_params['amount'] = CRM_Utils_Array::value('amount', $params) * 100;
699
700 if($tc_params['payments'] == 1) {
701 $tc_params['payments'] = 0;
702 }
703 $reply = $this->_sendTCRequest($tc_params);
704 $result = $this->_getTCReply($reply);
705
706 /* We are done, pass success */
707 return TRUE;
708
709 }
710
711 /**
712 * Installs the trustcommerce module (currently a dummy)
713 */
714 public function install() {
715 return TRUE;
716 }
717
718 /**
719 * Uninstalls the trustcommerce module (currently a dummy)
720 */
721 public function uninstall() {
722 return TRUE;
723 }
724
725 }
726