search

phpish / shopify

Simple Shopify API client in PHP
MIT License
62 stars 35 forks source link

Signature parameter no longer send #5

Open marekgach opened 8 years ago

marekgach commented 8 years ago

My code was working properly and somehow Shopify stopped to send signature parameter. This will lead to:

Notice: Undefined index: signature in **/vendor/phpish/shopify/shopify.php on line 21

in function is_valid_request while validating request. As stated here https://help.shopify.com/api/guides/authentication/oauth#verification says: The signature attribute is deprecated due to vulnerabilities in how the signature is generated.

So it is possible they removed it in previous days from Shopify? Any suggestions?

archimedesign commented 8 years ago

Not sure if that's related but I couldn't access one of my shops on 26th May and here's the reply from their support, maybe they were changing something at the time: "We experienced a brief outage earlier in the day, however the team has resolved the issue." On 2 Jun 2016 16:37, "Marek Gach" notifications@github.com wrote:

My code was working properly and somehow Shopify stopped to send signature parameter. This will lead to:

Notice: Undefined index: signature in **/vendor/phpish/shopify/shopify.php on line 21

in function is_valid_request while validating request. As stated here https://help.shopify.com/api/guides/authentication/oauth#verification says: The signature attribute is deprecated due to vulnerabilities in how the signature is generated.

So it is possible they removed it in previous days from Shopify? Any suggestions?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/phpish/shopify/issues/5, or mute the thread https://github.com/notifications/unsubscribe/AGe91kJ9YYpovixyzZzJGja-KSl6n_Foks5qHvidgaJpZM4IssFN .

marekgach commented 8 years ago

MD5 signature is no longer supported since 1st June. So it may be fixed like this: https://github.com/hsleewis/shopify/commit/fced4542010fcc566472fc6fefb36e195872fd49

However even this solution is not working for me when I verify the request for plugin preferences page. Because this request has some different parameters and SHA hash does not match at all.

hellozach commented 8 years ago

@marekgach - wrap the http_build_query() in urldecode()

See here: https://github.com/phpish/shopify/pull/4#issuecomment-223304261

ajrana000 commented 7 years ago

Please check this : https://github.com/phpish/shopify/pull/6

It will solve this issue.

LukeTowers commented 6 years ago

@marekgach @archimedesign @hellozach @ajrana000 feel free to give my version a try: https://github.com/LukeTowers/php-shopify-api