search

aporat / store-receipt-validator

PHP receipt validator for Apple iTunes, Google Play and Amazon App Store
Apache License 2.0
633 stars 153 forks source link

Response modifications and ios receipt hack protection #39

Closed stanimir-kukudov closed 7 years ago

aporat commented 7 years ago

thank you for the pull request. do you mind forking the repository again and creating a fresh pull request? there were some changes since you last forked the repo.

also - can you explain about the hack protection? i'm curious how validating a receipt without purchases can cause any issues.

stanimir-kukudov commented 7 years ago

Hi,

I will create a fresh pull request tomorrow. About the protection there is a way to hack apple receipt and the status is 0 (which means that the receipt is ok) but there are no purchases in it because there is actually no payment. When it is payed the normal way there can't be a receipt without a purchase in it.

On Tue, Jan 3, 2017 at 7:18 PM, Adar Porat notifications@github.com wrote:

thank you for the pull request. do you mind forking the repository again and creating a fresh pull request? there were some changes since you last forked the repo.

also - can you explain about the hack protection? i'm curious how validating a receipt without purchases can cause any issues.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/aporat/store-receipt-validator/pull/39#issuecomment-270168604, or mute the thread https://github.com/notifications/unsubscribe-auth/AH-YGsgWPUthH-hmz9zih17fIpuWylk8ks5rOoL1gaJpZM4LZirN .

-- Stanimir Kukudov Server-Side Developer - Lecturio GmbH www.lecturio.de

Adresse: Käthe-Kollwitz-Str. 1 | 04109 Leipzig E-Mail: my email@lecturio.de stefan.wisbauer@lecturio.de

Registergericht: Amtsgericht Leipzig, HRB 24295 Geschäftsführer: Martin Schlichte, Pascal Bendien, Stefan Wisbauer

Lecturio Blog http://blog.lecturio.de/ | Werden Sie ein Lecturio-Fan auf Facebook http://www.facebook.com/pages/Lecturio/97861721974. | Folgen Sie uns auf Twitter http://twitter.com/lecturio.

aporat commented 7 years ago

hi @stanimir-kukudov, i merged the changes related to google play and the empty receipt issue.

regarding the subscription changes - I ended up adding a PurchaseItem object. not sure it's a good idea to add those last purchase vars on the Response object directly, as itunes returns an array of purchases. the new getPurchases will return an array of PurchaseItem objects and not an scalar array. the PurchaseItem has a getExpiresDate() method

i haven't touched google play validator, as I don't use that store anymore and don't have a way to test it