[Bambora] How is «MD5 Key» used?

dmitry_fedyuk · July 3, 2021, 12:48pm

The MD5 key is used to stamp data sent between Magento and Bambora to prevent it from being tampered with.
The MD5 key is optional but if used here, must be the same as in the Bambora administration.

github.com

bambora/checkout-magento-v2.x/blob/v2.2.2/etc/adminhtml/system/bambora_checkout.xml#L54-L58


      
          <field id="md5key" type="text" translate="label comment" sortOrder="7" showInDefault="1" showInWebsite="1" showInStore="1">
            <label><![CDATA[<b>MD5 Key:</b>]]></label>
            <comment><![CDATA[The MD5 key is used to stamp data sent between Magento and Bambora to prevent it from being tampered with. The MD5 key is optional but if used here, must be the same as in the Bambora administration.]]></comment>
            <config_path>payment/bambora_checkout/md5key</config_path>
          </field>

github.com

bambora/checkout-magento-v2.x/blob/v2.2.2/Helper/BamboraConstants.php#L35-L35


      
          const MD5_KEY = 'md5key';

1. `Bambora\Online\Helper\Data::calcEpayMd5Key()`

github.com

bambora/checkout-magento-v2.x/blob/v2.2.2/Helper/Data.php#L328-L359


      
          /**
           * Calculate Md5key hash
           *
           * @param  \Magento\Sales\Model\Order                     $order
           * @param  \Bambora\Online\Model\Api\Epay\Request\Payment $paymentRequest
           * @return string
           */
          public function calcEpayMd5Key($order, $paymentRequest)
          {
              $shopMd5 = $this->getBamboraEpayConfigData(BamboraConstants::MD5_KEY, $order->getStoreId());
              $md5stampsValueString = $paymentRequest->encoding.
                          $paymentRequest->cms.
                          $paymentRequest->windowstate.
                          $paymentRequest->mobile.
                          $paymentRequest->merchantnumber.
                          $paymentRequest->windowid.
                          $paymentRequest->amount.
                          $paymentRequest->currency.
                          $paymentRequest->orderid.
                          $paymentRequest->accepturl.

This file has been truncated. show original

2. `Bambora\Online\Controller\Checkout\Callback::validateCallback()`

github.com

bambora/checkout-magento-v2.x/blob/v2.2.2/Controller/Checkout/Callback.php#L89-L102


      
          $shopMd5 = $this->_bamboraHelper->getBamboraCheckoutConfigData(BamboraConstants::MD5_KEY, $order->getStoreId());
          $var = "";
          if (strlen($shopMd5) > 0) {
              foreach ($posted as $key => $value) {
                  if ($key === "hash") break;
                  $var .= $value;
              }
          
              $genstamp = $this->_bamboraHelper->getHashFromString($var . $shopMd5);
              if ($genstamp != $posted["hash"]) {
                  $message .= "Bambora MD5 check failed";
                  return false;
              }
          }

3. `Bambora\Online\Controller\Epay\Callback::validateCallback()`

github.com

bambora/checkout-magento-v2.x/blob/v2.2.2/Controller/Epay/Callback.php#L85-L103


      
              $shopMd5 = $this->_bamboraHelper->getBamboraEpayConfigData(BamboraConstants::MD5_KEY, $order->getStoreId());
              if (!empty($shopMd5)) {
                  $var = "";
          
                  foreach ($posted as $key => $value) {
                      if ($key !== "hash") {
                          $var .= $value;
                      }
                  }
          
                  $genstamp = $this->_bamboraHelper->getHashFromString($var . $shopMd5);
                  if ($genstamp != $posted["hash"]) {
                      $message .= "Bambora MD5 check failed";
                      return false;
                  }
              }
          
              return true;
          }

dmitry_fedyuk · July 4, 2021, 5:49pm

[Bambora] How is «MD5 Key» used?

1. Bambora\Online\Helper\Data::calcEpayMd5Key()

2. Bambora\Online\Controller\Checkout\Callback::validateCallback()

3. Bambora\Online\Controller\Epay\Callback::validateCallback()

1. `Bambora\Online\Helper\Data::calcEpayMd5Key()`

2. `Bambora\Online\Controller\Checkout\Callback::validateCallback()`

3. `Bambora\Online\Controller\Epay\Callback::validateCallback()`