Thread

I’m actually surprised that it works at PayPal without using SSL.  You’re retransmitting that entire array across the connection, so I wouldn’t recommend it.  If I knew that a place I was shopping at was going to do that, I’d go elsewhere.  It should be a simple fix for the host; I think it’s a bug in an older version of that library, as it sounds familiar.  Let us know how it goes!

Will certainly let you know how it goes Derek.

I’m just talking about keeping it this way for testing pre-launch, not planning to run it unsecured live. I am very keen to get this all working as it’s supposed to.

That said, the code in the SCM module does seem to provide the possibility of using non https URLs if the function openssl_open doesn’t exist (lines 381+), so perhaps that’s something you’d like to look into….

Non-SSL is not an option we would add for anything dealing with commerce.  Again, I’m shocked PayPal even allows it.

I take your point and agree Derek, but that is what is in the code. Look for yourself. Or am I misunderstandng how it works…?

Hm, yes, I see Paul left that in - and PayPal only seems to “recommend” SSL for IPN verification.  So:

That said, the code in the SCM module does seem to provide the possibility of using non https URLs if the function openssl_open doesn’t exist (lines 381+), so perhaps that’s something you’d like to look into….

$url = ( ! function_exists('openssl_open')) ? 'http://www.paypal.com/cgi-bin/webscr' : 'https://www.paypal.com/cgi-bin/webscr';

This is precisely what that code does, but in your case, the server defines it as being available, but probably has an older curl library installed with the aforementioned bug.  There’s not anything EE can do at that point, since the PHP environment is indicating that everything required is in place.

Yes, was just reading that in their order management integration guide myself:

NOTE: You can implement IPN without SSL, but PayPal recommends against doing so.

My host has got back to me and told me that

While curl from the command line has ssl support the apache compiled version does not

They are rebuilding the server now so I should be able to test it again in about an hour apparently. I’ll let you know how that goes.

Great, gotta love a fast and knowledgeable response from a hosting provider!

Paypal also says this re IPN:

Because credit card and bank information is not transmitted in Instant Payment Notification (IPN), PayPal does not require Secure Sockets Layer (SSL) to encrypt IPN transmissions.

Spotted this too:

IPNs will also POST for eCheck clearings, reversals, and refunds.

Does this work with SCM, or does it just track purchases?

Yes, I had to tell them where to look…. but then they’d not hit this problem before. They’re usually pretty good though and do respond rapidly to queries.

SCM will be pinged for anything PayPal pings IPNs for, but natively it only tracks purchases.  There are extension hooks in place though that would allow you to handle any type of processing you wanted to accommodate.

Thanks for clarifying Derek. I need to use one of the hooks in any case as I have to track an amount that’s related to the purchase for future use, so I may well look into that too so it’s all nice and tidy. See what time allows.

Do you know for certain whether buyers have to be verified at Paypal for an IPN to be triggered? I know EE’s docs say yes, but there seems to be some disagreement in the forums, and so far I’ve not seen anything to that effect at Paypal’s end - not that this is indicative of anything necessarily.

Back to the topic: all seems to be working my end now (hooray!) so I guess the hosting guys have finished what they needed to do, but I am still awaiting official confirmation from them.

Edit: I thought EE’s docs said yes, but now wonder whether I imagined it. Need more sleep. Question still applies though.

At the time the EE docs were written, that was the case.  PayPal has floated and changed on some issues, though, and they don’t always accurately or thoroughly document various aspects of their API, so it’s possible that’s not the case anymore.

Glad everything’s back up, let us know if you need help with any other issues!