search

academe / Omnipay-Wirecard

Wirecard payment gateway driver for the Omnipay
GNU Lesser General Public License v3.0
1 stars 0 forks source link

Determine what gets hashed #2

Closed judgej closed 7 years ago

judgej commented 7 years ago

It seems that the merchant site chooses what fields are included in the data hash when POSTing to the remote payment page. There could be instances where everything has to remain unchanged, so all fields are hashed. There could also be times where some details (e.g. billing address) are left open so they can be edited before going to the offsite payment form. I could even imagine the amount being left unhashed if an arbitrary donation is being paid.

So, how do we indicate what gets hased and what is not hashed? Group fields perhaps - addresses, names, amount - and have flags for ewach of these? Assume everything is hashed unless a hash is disabled for fields or groups? Any other approach?

judgej commented 7 years ago

Propbably, for now, just assume the POST to the gateway payment page will be automated, so nothing should be changed by a user. Any user-entered changes happen before getting to the auto-post.

judgej commented 7 years ago

We are hashing everything generated by the gateway. The merchant site can add further fields outside of the driver, so long as those fields only optionally appear in the fingerprint.