First Commit

exPayment.php

@@ -0,0 +1,344 @@
+<?php
+  $noSession = 1;
+  require("db.php");
+  include("include/school-functions.php");
+  include("include/logging-functions.php");
+  include("include/date-time.php");
+
+  // startLog("exPayment.php");
+
+
+
+  // Set time values for posting
+  date_default_timezone_set("Canada/Pacific");
+  $ptime = time();
+  $time = date("Y-m-d H:i:s",$ptime);
+  $ltime = date("Y-m-d.H.i.s",$ptime);
+
+
+  // output date and POST-ed values for logging
+  $contents = (date('r') . "\n\n");
+  $x = $_REQUEST;
+  $contents .= print_r($x, TRUE);
+  // writeLog($contents);
+  $contents .= "\n\n";
+
+
+
+  // Get cookie info
+  if (!array_key_exists('merchant_cookie_1',$_REQUEST)) exit();
+  if (!array_key_exists('merchant_cookie_2',$_REQUEST)) exit();
+
+  $school_num = intval($_REQUEST['merchant_cookie_1']);
+  $user_num = intval($_REQUEST['merchant_cookie_2']);
+
+
+  // start capturing output
+  function saveOutput($contents) {
+    global $ltime, $school_num;
+
+    $f = fopen("/m/data1/app.hotlunches.net/exPayment.log", "w");
+    fwrite($f, $contents);
+    fclose($f);
+
+    $f = fopen("/m/data1/app.hotlunches.net/exPayment.trx.log", "a");
+    fwrite($f, $contents);
+    fclose($f);
+
+    $f = fopen("/m/data1/app.hotlunches.net/logs/exact/ex.$school_num.$ltime", "w");
+    fwrite($f, $contents);
+    fclose($f);
+
+    return nl2br(htmlentities($contents));
+  }
+
+
+
+  //
+  // Process parameters to script
+  //
+  $action = $_REQUEST['action'];
+  if (strlen($action) == 0 || ($action != 'cancelled' && $action != 'done')) {
+    saveOutput($contents);
+    exit();
+  }
+
+  if ($action == 'cancelled') {
+    saveOutput($contents);
+    include "exPaymentCancelled.php";
+    exit();
+  }
+
+
+  // Handle the response_code
+  switch ($_POST['x_response_code']) {
+    case 1:
+      $trxResult = "Approved";
+      $trxMsg    = "Thank you, your payment has been processed.";
+      break;
+
+    case 2:
+      $trxResult = "Declined";
+      $trxMsg    = "Your payment has been declined.<br>\nPlease contact ESNS to make a payment on your account.";
+      break;
+
+    case 3:
+      $trxResult = "Error";
+      $trxMsg    = "There has been an error processing your payment. Your payment has been processed.<br>\nPlease contact ESNS to make a payment on your account.";
+
+      if (array_key_exists('Bank_Resp_Code',$_REQUEST) && $_REQUEST['Bank_Resp_Code'] != "000") {
+         $trxMsg   .= "<br>\n";
+         $trxMsg   .= "<br>\n";
+         $trxMsg   .= $_REQUEST['Bank_Resp_Code'] . " - " . $_REQUEST['Bank_Message'];
+      }
+      break;
+  }
+
+
+
+  $bank_resp_code = '';
+  $posting_message = '';
+  $trxNum = '';
+  $error_message = '';
+
+  // Parse POST-ed values
+  $trx_result = $trxResult;
+  $trx_msg = $trxMsg;
+  if (array_key_exists('x_invoice_num', $_REQUEST)) $trxNum = db_escape_string($_REQUEST['x_invoice_num']);
+  $trx_num = $trxNum;
+  $invoice_num = $_REQUEST['x_invoice_num'];
+  $authorization_num = $_REQUEST['Authorization_Num'];
+  $response_code = $_REQUEST['x_response_code'];
+  $response_reason_text = $_REQUEST['x_response_reason_text'];
+  if (array_key_exists('bank_resp_code', $_REQUEST)) $bank_resp_code = db_escape_string($_REQUEST['Bank_Resp_code']);
+  $bank_message = $_REQUEST['Bank_Message'];
+  $method = $_REQUEST['x_method'];
+  $card_type = $_REQUEST['TransactionCardType'];
+  $currency_code = $_REQUEST['x_currency_code'];
+  $card_holders_name = $_REQUEST['CardHoldersName'];
+  $card_number = $_REQUEST['Card_Number'];
+  $authorization_num = $_REQUEST['Authorization_Num'];
+  $amount = str_replace(",","",$_REQUEST['x_amount']);
+  $surcharge = str_replace(",","",$_REQUEST['SurchargeAmount']);
+  $exact_ctr = $_REQUEST['exact_ctr'];
+  $exact_message = $_REQUEST['EXact_Message'];
+  $merchant_name = $_REQUEST['MerchantName'];
+  $merchant_country = $_REQUEST['MerchantCountry'];
+  $posting_result = 'Incomplete';
+
+
+  // Create entry in user_exact_transactions table
+  $trxFields = array('trx_result','trx_msg','invoice_num','response_code','response_reason_text','bank_resp_code','bank_message','method','card_type','currency_code','card_holders_name',
+                     'card_number','authorization_num','exact_ctr','exact_message','merchant_name','merchant_country','trx_num','user_num','posting_result','posting_message');
+  $trxInsert = "school_num,posting_time,ptime,amount,surcharge";
+  $trxValues = "$school_num,'$time',$ptime,$amount,$surcharge";
+  for ($i = 0; $i < count($trxFields); $i++) {
+    $fieldName = $trxFields[$i];
+    $fieldValue = db_escape_string($$fieldName);
+    $trxInsert .= ",$fieldName";
+    $trxValues .= ",'$fieldValue'";
+  }
+  $trxSQL = "INSERT INTO user_exact_transactions ($trxInsert) VALUES ($trxValues)";
+  $contents .= "$trxSQL\n";
+  db_query($trxSQL);
+  $trxID = db_insert_id();
+  $contents .= "Insert ID: $trxID\n\n";
+
+
+  // Exit if transaction was not approved
+  if ($response_code != 1) {
+    $error_message = "Transaction not Approved";
+    $contents .= "$error_message\n\n";
+    saveOutput($contents);
+    header("Location: /exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=" . urlencode($error_message));
+    exit();
+  }
+
+
+  // Load school information from the database
+  $r = db_query("SELECT * FROM schools WHERE record_num = {$school_num}");
+  if (db_num_rows($r) != 1) {
+    $error_message = "Invalid school.";
+    $query = "UPDATE user_exact_transactions SET posting_result = 'Error', posting_message = 'Invalid school' WHERE record_num = $trxID";
+    $contents .= "$query\n";
+    db_query($query);
+    $contents .= "$error_message\n\n";
+    saveOutput($contents);
+    header("Location: /exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=" . urlencode($error_message));
+    exit();
+  } else {
+    extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 's');
+
+    if ($s_secure_certificate == 'Y') $URL = "https://$s_url";
+    else $URL = "http://$s_url";
+
+    if ($s_reseller != 'esns') {
+      $URL .= "/?form_message=".urlencode($trxMsg)."&error_message=";
+    }
+    else {
+      $URL .= "/exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=";
+    }
+  }
+
+
+  // Use the posted transaction number value to get the post values from DB
+  $query = "SELECT * FROM user_online_payments WHERE record_num = {$trxNum}";
+  $contents .= "$query\n";
+  $r = db_query($query);
+  if (db_num_rows($r) > 0) {
+    extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 'PMTS');
+    $user_num = $PMTS_user_num;
+  }
+  else {
+    $error_message = "Unexpected payment - no matching pending payment";
+    $contents .= "$error_message\n\n";
+    saveOutput($contents);
+    header("Location: $URL" . urlencode($error_message));
+    exit();
+  }
+
+
+  // Check if this entry is in the user_exact_transactions table
+  $query = "SELECT * FROM user_exact_transactions WHERE school_num = $school_num AND trx_num = $trx_num AND trx_result = '$trx_result' AND authorization_num = '$authorization_num' AND record_num != $trxID";
+  $contents .= "$query\n";
+  $r = db_query($query);
+  if (db_num_rows($r) > 0) {
+    $error_message = "Duplicate Posting - Transaction Has Already Been Processed: $trx_num";
+    $contents .= "$error_message\n\n";
+    saveOutput($contents);
+    header("Location: $URL" . urlencode($error_message));
+    exit();
+  }
+
+
+
+  // Update hotlunch_orders table
+  $query = "SELECT hloh.* FROM hotlunch_order_header as hloh, people as p " .
+           "WHERE hloh.school_num = {$school_num} " .
+           "AND ordered_by_num = p.record_num " .
+           "AND p.user_num = {$user_num} " .
+           "AND hloh.status NOT IN ('Paid','Complimentary','Concession')";
+  $contents .= "$query\n";
+  $orders = db_query($query);
+  $contents .= "Orders Found: " . db_num_rows($orders) . "\n";
+
+  $today = date("Y-m-d",$ptime);
+  $order_payments = "";
+  $snum = 0;
+  if (db_num_rows($orders) > 0) {
+    while ($row = db_fetch_array($orders)) {
+      $onum   = $row['record_num'];
+      $ototal = $row['order_total'];
+      $opaid  = $row['amount_paid'];
+      $snum   = $row['schedule_num'];
+      $amt = number_format($ototal - $opaid,2);
+      if (strlen($order_payments) > 0) $order_payments .= "|";
+      $order_payments .= "{" . $onum . ":" . $amt . "}";
+
+      $query = "UPDATE hotlunch_order_header " .
+               "SET amount_paid = order_total, " .
+                  "status = 'Paid', " .
+                  "paid_date = '$today', " .
+                  "payment_method = 'On-Line Payment' " .
+               "WHERE record_num = {$onum}";
+      $contents .= "$query\n";
+      db_query($query);
+
+      $contents .= " - Order Paid: $onum\n";
+    }
+  }
+
+  $contents .= "\n";
+
+
+  // Update online_payments database table
+  $query = "UPDATE user_online_payments " .
+           "SET status = 'Paid', payment_amount = balance_owing, reference = '{$authorization_num}', trx_fee = 0, completed_time = $ptime " .
+           "WHERE record_num = $trxNum";
+  $contents .= "$query\n";
+  db_query($query);
+
+
+  // Post transaction to the user_account
+  date_default_timezone_set(mapTimeZone($s_timezone));
+  $entered_time = $ptime;
+  $trx_time = date("Y-m-d H:i:s",$entered_time);
+
+  // Post transaction fee if there is one
+  if ($PMTS_transaction_fee != 0) {
+    if ($PMTS_transaction_fee > 0) {
+      $query = "INSERT INTO user_account " .
+               "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
+               "VALUES ($school_num,$user_num,$snum,'$trx_time','Credit Card Transaction Fee','Closed','',$PMTS_transaction_fee,$PMTS_transaction_fee,0,'Credit Card','$authorization_num',NULL,'N',$entered_time)";
+    }
+    else {
+      $query = "INSERT INTO user_account " .
+               "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
+               "VALUES ($school_num,$user_num,$snum,'$trx_time','Transaction Credit','Closed','',$PMTS_transaction_fee,$PMTS_transaction_fee,0,'Credit Card','$authorization_num',NULL,'N',$entered_time)";
+    }
+    $contents .= "$query\n";
+    db_query($query);
+    $entered_time += 1;
+    $trx_time = date("Y-m-d H:i:s",$entered_time);
+  }
+
+  // Insertpayment transaction
+  $amount = $amount * -1;
+  $query = "INSERT INTO user_account " .
+           "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,payment_method,payment_reference,order_payments,deleted,entered_time,transaction_status) " .
+           "VALUES ($school_num,$user_num,$snum,'$trx_time','Payment','On-Line Payment',$amount,'$method','$authorization_num','$order_payments','N',$entered_time,'Closed')";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Update any open charge transactions
+  $query = "UPDATE user_account SET payment_method = '$method', payment_reference = '$authorization_num', payment_time = $entered_time " .
+           "WHERE school_num = $school_num AND user_num = $user_num AND transaction_status = 'Open' AND transaction_amount > 0";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Close all transactions
+  $query = "UPDATE user_account SET transaction_status = 'Closed' WHERE school_num = $school_num AND user_num = $user_num";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Update all orders to set amount paid
+  $query = "UPDATE user_account SET amount_paid = transaction_amount WHERE school_num = $school_num AND user_num = $user_num AND transaction_amount > 0";
+  $contents .= "$query\n";
+  db_query($query);
+
+
+  // Make activity_log entry
+  $username = db_getVal("SELECT userid FROM users WHERE school_num = $school_num AND record_num = $user_num");
+  $activity = "On-Line Payment";
+  if (!isset($trx_num)) $trx_num = '';
+  $additional_info = "TRX ID: $trx_num\nAmount: " . number_format(abs($amount),2) . "\n";
+  $curr_time = $ptime;
+  $activity_datetime = date("Y-m-d H:i:s",$curr_time);
+  $uid = db_escape_string($username);
+  $query = "insert into activity_log (school_num,userid,user_ip,activity_time,activity_datetime,activity,information) " .
+           "values($school_num,'$uid','0.0.0.0',$curr_time,'$activity_datetime','$activity','$additional_info')";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Reset user transaction status
+  $query = "update users set trx_status = NULL where school_num = $school_num and record_num = $user_num";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Reset user can_order flag
+  $query = "update users set can_order = 'Yes' where school_num = $school_num and can_order = 'Balance' and record_num = $user_num";
+  $contents .= "$query\n";
+  db_query($query);
+
+  // Update user_exact_transactions
+  $query = "UPDATE user_exact_transactions SET posting_message = 'Payment processed ok', posting_result = 'Posted' WHERE record_num = $trxID";
+  $contents .= "$query\n";
+  db_query($query);
+  $contents .= "Payment processed ok\n\n\n";
+
+  adjustUserAccountDetails($user_num,$school_num);
+
+  saveOutput($contents);
+  header("Location: $URL" . urlencode($error_message));
+
+?>