RT#37632: Credit card validation [v3, saving from payment.cgi]

[freeside.git] / httemplate / misc / process / payment.cgi

diff --git a/httemplate/misc/process/payment.cgi b/httemplate/misc/process/payment.cgi
index d9299e5..dcfcc0b 100644 (file)
--- a/httemplate/misc/process/payment.cgi
+++ b/httemplate/misc/process/payment.cgi
@@ -74,11 +74,13 @@ $cgi->param('balance') =~ /^\s*(\-?\s*\d*(\.\d\d)?)\s*$/
 my $balance = $1;
 
 my $payinfo;
+my $paymask; # override only used by loaded cust payinfo, only implemented for realtime processing
 my $paycvv = '';
 if ( $payby eq 'CHEK' ) {
 
   if ($cgi->param('payinfo1') =~ /xx/i || $cgi->param('payinfo2') =~ /xx/i ) {
     $payinfo = $cust_main->payinfo;
+    $paymask = $cust_main->paymask;
   } else {
     $cgi->param('payinfo1') =~ /^(\d+)$/
       or errorpage("Illegal account number ". $cgi->param('payinfo1'));
@@ -99,17 +101,26 @@ if ( $payby eq 'CHEK' ) {
   $payinfo = $cgi->param('payinfo');
   if ($payinfo eq $cust_main->paymask) {
     $payinfo = $cust_main->payinfo;
+    $paymask = $cust_main->paymask;
   }
   $payinfo =~ s/\D//g;
   $payinfo =~ /^(\d{13,16}|\d{8,9})$/
-    or errorpage(gettext('invalid_card')); # . ": ". $self->payinfo;
+    or errorpage(gettext('invalid_card'));
   $payinfo = $1;
   validate($payinfo)
-    or errorpage(gettext('invalid_card')); # . ": ". $self->payinfo;
+    or errorpage(gettext('invalid_card'));
 
-  errorpage(gettext('unknown_card_type'))
-    if $payinfo !~ /^99\d{14}$/ #token
-    && cardtype($payinfo) eq "Unknown";
+  unless ( $payinfo =~ /^99\d{14}$/ ) { #token
+
+    my $cardtype = cardtype($payinfo);
+
+    errorpage(gettext('unknown_card_type'))
+      if $cardtype eq "Unknown";
+
+    my %bop_card_types = map { $_=>1 } values %{ card_types() };
+    errorpage("$cardtype not accepted") unless $bop_card_types{$cardtype};
+
+  }
 
   if ( defined $cust_main->dbdef_table->column('paycvv') ) {
     if ( length($cgi->param('paycvv') ) ) {
@@ -145,14 +156,18 @@ if ( $cgi->param('save') ) {
   } else {
     die "unknown payby $payby";
   }
-  $new->payinfo($payinfo); #to properly set paymask
+  $new->payinfo($payinfo);             # sets default paymask, but not if it's already tokenized
+  $new->paymask($paymask) if $paymask; # in case it's been tokenized, override with loaded paymask
   $new->set( 'paydate' => "$year-$month-01" );
   $new->set( 'payname' => $payname );
 
   #false laziness w/FS:;cust_main::realtime_bop - check both to make sure
   # working correctly
   if ( $payby eq 'CARD' &&
-       grep { $_ eq cardtype($payinfo) } $conf->config('cvv-save') ) {
+       ( (grep { $_ eq cardtype($payinfo) } $conf->config('cvv-save')) 
+         || $conf->exists('business-onlinepayment-verification') 
+       )
+  ) {
     $new->set( 'paycvv' => $paycvv );
   } else {
     $new->set( 'paycvv' => '');
@@ -187,7 +202,7 @@ if ( $cgi->param('batch') ) {
                                      'payinfo'  => $payinfo,
                                      'paydate'  => "$year-$month-01",
                                      'payname'  => $payname,
-                                     map { $_ => $cgi->param($_) } 
+                                     map { $_ => scalar($cgi->param($_)) } 
                                        @{$payby2fields{$payby}}
                                    );
   errorpage($error) if $error;
@@ -199,13 +214,16 @@ if ( $cgi->param('batch') ) {
     'manual'     => 1,
     'balance'    => $balance,
     'payinfo'    => $payinfo,
+    'paymask'    => $paymask,
     'paydate'    => "$year-$month-01",
     'payname'    => $payname,
     'payunique'  => $payunique,
     'paycvv'     => $paycvv,
     'paynum_ref' => \$paynum,
     'discount_term' => $discount_term,
-    map { $_ => $cgi->param($_) } @{$payby2fields{$payby}}
+    'no_auto_apply' => ($cgi->param('apply') eq 'never') ? 'Y' : '',
+    'no_invnum'     => 1,
+    map { $_ => scalar($cgi->param($_)) } @{$payby2fields{$payby}}
   );
   errorpage($error) if $error;
 
@@ -225,7 +243,7 @@ if ( $cgi->param('batch') ) {
 
   }
 
-  $cust_main->apply_payments;
+  $cust_main->apply_payments if ($cgi->param('apply') eq 'yes');
 
 }