globalpayments / php-sdk

GNU General Public License v2.0
49 stars 66 forks source link

Incorrect serialization of zero-value amounts in RealexConnector::serializeRequest #47

Closed JeremySkinner closed 2 years ago

JeremySkinner commented 4 years ago

Hi,

RealexConnector::serializeRequest doesn't appear to handle zero-value amounts correctly. A zero-value amount is valid in some situations (for example, storing a card via HPP without an amount for the purpose of paying the user at a later stage).

This log is used in several places:

https://github.com/globalpayments/php-sdk/blob/94bfa579d6fd415c457bacf70389f73c3f9f17c3/src/Gateways/RealexConnector.php#L526

For non-zero decimal values, this removes the decimal point (eg converting £ to pennies):

$amount = 2.99;
preg_replace('/[^0-9]/', '', sprintf('%01.2f', $amount))

=> "299"

...which means for a zero-value, it produces a value of "000":

$amount = 0.00;
preg_replace('/[^0-9]/', '', sprintf('%01.2f', $amount))

=> "000"

Unfortunately a value of "000" is rejected by the server-side API, returning a message of Insufficient AMOUNT specified. Please contact the merchant.. In this case, the serialized value for the amount needs to be literally "0", not "000" in order to successfully pass validation.

The old HPP SDK didn't have this problem.

Proposed solution

Everywhere that calls preg_replace('/[^0-9]/', '', sprintf('%01.2f', $builder->amount)) should also add a special case for handling zeros, and use "0" instead.