Hello i am using hosted payment SDK i have setup all the thing but not able to understand how to use hosted-payment-sim and how to use x_signature in case of if i have accept all the post request parameter and after success full transaction what i need to do to redirect to shopify store

An issue was detected, the package rack-protection at its current version 1.5.3
is vulnerable to 2018-7212.

Please update to >= 2.0.1 or ~> 1.5.4.

@pi3r your change in fc02209 introduced a vulnerability, because the package rubyzip at its current version 1.2.0 is vulnerable to 2017-5946.
Please update to >= 1.2.1.

Steps to reproduce:

• Go to: https://staging-slatecollection.myshopify.com/products/qa-reject-303 (may need to use new incognito window)
• Add product to cart
• Click View cart
• Click Check out
• Enter email and shipping details then click Complete order
• On the Paymetrics/Lemonade hosted payment page, enter card number 4444444444444448 with future expiration date and any 3 digits in CVV
• Click Complete Order on Paymetrics/Lemonade page
• Result should be Payment failed: Rejected message on Shopify-hosted checkout page
• Click Complete order on Shopify "Payment failed: Rejected" page, which will take you back through the Paymetrics flow
• Repeat the process of entering card details above and click "Complete order" on Paymetrics page
• Result is the "Order confirmation page" at checkout.shopify.com/.../thank_you
• No order is created in test store (staging-slatecollection.myshopify.com)

@pi3r

Hi

what are the values being considered by the request signing mechanism

the attached example is giving me: "334afa5d86d80cd5b4b3488bccd5c50b4e43dab7d595cc8e63732c3578c55012"

if I do it I'm getting

"a1fed8096b305795d4388a4838b042abeb0e4fc53d4a4c0c01c89f0590ff494b"

The following fields are not being considered in the offsite gateway sim
x_transaction_type
x_timestamp

The following fields are not being considered in the request calculator
x_customer_shipping_first_name
x_customer_shipping_last_name

Is this possible? I've been searching everywhere for a solution and have so far come up empty. I have seen that there are a number of ways to make a store multilingual in Shopify, but I cannot seem to find any way to communicate the current language of the store to the payment gateway.

One possible 'solution' suggested by Shopify in the forums is to use the store's country (and maybe the customer's address) to try to make an intelligent guess as to what language to use. This is partially helpful, but could still be wrong - irritating the customer and potentially losing a sale.

The easiest way to solve this as far as I can see would be for Shopify to simply send through the language code from the checkout to the payment gateway. This would seem an easy thing to do, and would provide great benefit for 3rd party payment gateway developers like myself

Hi, I'm having trouble matching the signature Shopify generates for a shop with the character "®" in it's shop name.

The signature I generate is: f45ce49a4dcf227d0935a3378129bb183eb50b6c73fbce00389b7e13cbb4a155 vs. the signature Shopify generate for the same response params which is: 7b61044affc253f0485f08c44f071a37c9535f3aedf4362bd5197725f0b39ddc

Please see the full request params below, ignore the slashes this is because I've stringified the json request body.

"{\"utf8\":\"✓\",\"authenticity_token\":\"Ya5BYUm9is1JyEAjVT5ZxfAzPKxjGw0t4ft0oH1NrNBME9qwmqYF98BaGvt68236Gmd8GK1xR0RwYyoa5RvJsg==\",\"x_reference\":\"10881755009\",\"x_account_id\":\"gofreepants\",\"x_amount\":\"98.00\",\"x_currency\":\"USD\",\"x_url_callback\":\"https://checkout.shopify.com/services/ping/notify_integration/payzing/2261955\",\"x_url_complete\":\"https://checkout.shopify.com/2261955/checkouts/5cb8e76546df8d244f8a6cd01815664d/offsite_gateway_callback\",\"x_shop_country\":\"US\",\"x_shop_name\":\"Go Free® Pants\",\"x_test\":\"false\",\"x_customer_first_name\":\"Daniel\",\"x_customer_last_name\":\"Webb\",\"x_customer_email\":\"[email protected]\",\"x_customer_phone\":\"+441271344265\",\"x_customer_billing_country\":\"GB\",\"x_customer_billing_city\":\"Barnstaple\",\"x_customer_billing_company\":\"Mr.\",\"x_customer_billing_address1\":\"weirside way\",\"x_customer_billing_zip\":\"EX327RB\",\"x_customer_billing_phone\":\"+441271344265\",\"x_customer_shipping_country\":\"GB\",\"x_customer_shipping_first_name\":\"Daniel\",\"x_customer_shipping_last_name\":\"Webb\",\"x_customer_shipping_city\":\"Barnstaple\",\"x_customer_shipping_company\":\"Mr.\",\"x_customer_shipping_address1\":\"weirside way\",\"x_customer_shipping_zip\":\"EX327RB\",\"x_customer_shipping_phone\":\"+441271344265\",\"x_invoice\":\"#10881755009\",\"x_description\":\"Go Free® Pants - #10881755009\",\"x_url_cancel\":\"http://gofreepants.myshopify.com/cart\",\"x_signature\":\"7b61044affc253f0485f08c44f071a37c9535f3aedf4362bd5197725f0b39ddc\"}"

I use the node.js crypto library to generate the signature like so:

       var message = Object.keys(params).sort().map(function(key) {
            if(key!=='x_signature' && ~key.indexOf('x_')) return key+params[key];
        }).join('');

        var hmac = crypto.createHmac('SHA256', String(secret));
        hmac.setEncoding('hex');
        hmac.write(message);
        hmac.end();

        return hmac.read();

Where params is the request body and secret is the correct gateway secret for the shop. This is heavily tested and works across many shops, the same code works on this shop if ® is removed from the shops name.

I noticed the calculator https://offsite-gateway-sim.herokuapp.com/calculator is a bit outdated as it's fields are different to what Shopify POST's most notably shopify posts x_customer_shipping_first_name & x_customer_shipping_last_name but the calculator has billing first and last name fields instead of shipping so this is likely the cause of the calculator generating an entirely different result? Below is my request on the calculator the "secret_key" is there but it's cut off the bottom of the screenshot as wanted to keep it private. Note that I manually changed the billing first and last name fields to match the request from Shopify. It's given me the signature d8336dc1970dc5527cd1c9c5303ebf582c4be73c5bf8950098f08a683df9b5c1 which matches neither mine nor Shopify's.

@pi3r your change in fc02209 introduced a vulnerability, because the package rest-client at its current version 1.6.9 is vulnerable to 2015-3448.
Please update to >= 1.7.3.

Is there any reference app for hosted payment in rails ??

Owners: @Shopify/payments
Service: hosted-payment-sim/production
App: offsite-gateway-sim

TL;DR: Automatic updates failed on your repo. Manual intervention is required. Your app will miss out on automatic updates until the issue is resolved

What's up?

Services DB's automatic update job failed for your repo while trying to update the following gem(s):

• rack-protection

Why?

Reasons vary but there are some more frequent than others:

• Make sure there are no dependencies hosted on github in your gemfile. See here for more details
• We may not be able to process updates automatically if one of your dependencies is locked to a very narrow or specific version
  • e.g. gem 'rails', '5.0.0'

So what do you do?

You'll have to manually update your dependencies. You can see a list of those that Dev Accel has deemed important to update here.

Once you close this issue, automatic updates will resume for this service. If you close this issue but don't fix the underlying problem, it'll re-open again next time we try to update your project, so don't get cheeky 😉

Come chat to us in #servicesdb if you have any questions.

Happy Updating!

Failure Details

Could not find gem 'ruby� (~> 2.1.8.0)' in any of the gem sources listed in your Gemfile.

@pi3r your change in fc02209 introduced a vulnerability, because the package rest-client at its current version 1.6.9 is vulnerable to 2015-1820.
Please update to >= 1.8.0 or <= 1.6.0.

This repository relies on CircleCI v1.0 which will be shut down on Aug 31st.