345 lines
13 KiB
PHP
345 lines
13 KiB
PHP
<?php
|
|
$noSession = 1;
|
|
require("db.php");
|
|
include("include/school-functions.php");
|
|
include("include/logging-functions.php");
|
|
include("include/date-time.php");
|
|
|
|
// startLog("exPayment.php");
|
|
|
|
|
|
|
|
// Set time values for posting
|
|
date_default_timezone_set("Canada/Pacific");
|
|
$ptime = time();
|
|
$time = date("Y-m-d H:i:s",$ptime);
|
|
$ltime = date("Y-m-d.H.i.s",$ptime);
|
|
|
|
|
|
// output date and POST-ed values for logging
|
|
$contents = (date('r') . "\n\n");
|
|
$x = $_REQUEST;
|
|
$contents .= print_r($x, TRUE);
|
|
// writeLog($contents);
|
|
$contents .= "\n\n";
|
|
|
|
|
|
|
|
// Get cookie info
|
|
if (!array_key_exists('merchant_cookie_1',$_REQUEST)) exit();
|
|
if (!array_key_exists('merchant_cookie_2',$_REQUEST)) exit();
|
|
|
|
$school_num = intval($_REQUEST['merchant_cookie_1']);
|
|
$user_num = intval($_REQUEST['merchant_cookie_2']);
|
|
|
|
|
|
// start capturing output
|
|
function saveOutput($contents) {
|
|
global $ltime, $school_num;
|
|
|
|
$f = fopen("/m/data1/app.hotlunches.net/exPayment.log", "w");
|
|
fwrite($f, $contents);
|
|
fclose($f);
|
|
|
|
$f = fopen("/m/data1/app.hotlunches.net/exPayment.trx.log", "a");
|
|
fwrite($f, $contents);
|
|
fclose($f);
|
|
|
|
$f = fopen("/m/data1/app.hotlunches.net/logs/exact/ex.$school_num.$ltime", "w");
|
|
fwrite($f, $contents);
|
|
fclose($f);
|
|
|
|
return nl2br(htmlentities($contents));
|
|
}
|
|
|
|
|
|
|
|
//
|
|
// Process parameters to script
|
|
//
|
|
$action = $_REQUEST['action'];
|
|
if (strlen($action) == 0 || ($action != 'cancelled' && $action != 'done')) {
|
|
saveOutput($contents);
|
|
exit();
|
|
}
|
|
|
|
if ($action == 'cancelled') {
|
|
saveOutput($contents);
|
|
include "exPaymentCancelled.php";
|
|
exit();
|
|
}
|
|
|
|
|
|
// Handle the response_code
|
|
switch ($_POST['x_response_code']) {
|
|
case 1:
|
|
$trxResult = "Approved";
|
|
$trxMsg = "Thank you, your payment has been processed.";
|
|
break;
|
|
|
|
case 2:
|
|
$trxResult = "Declined";
|
|
$trxMsg = "Your payment has been declined.<br>\nPlease contact ESNS to make a payment on your account.";
|
|
break;
|
|
|
|
case 3:
|
|
$trxResult = "Error";
|
|
$trxMsg = "There has been an error processing your payment. Your payment has been processed.<br>\nPlease contact ESNS to make a payment on your account.";
|
|
|
|
if (array_key_exists('Bank_Resp_Code',$_REQUEST) && $_REQUEST['Bank_Resp_Code'] != "000") {
|
|
$trxMsg .= "<br>\n";
|
|
$trxMsg .= "<br>\n";
|
|
$trxMsg .= $_REQUEST['Bank_Resp_Code'] . " - " . $_REQUEST['Bank_Message'];
|
|
}
|
|
break;
|
|
}
|
|
|
|
|
|
|
|
$bank_resp_code = '';
|
|
$posting_message = '';
|
|
$trxNum = '';
|
|
$error_message = '';
|
|
|
|
// Parse POST-ed values
|
|
$trx_result = $trxResult;
|
|
$trx_msg = $trxMsg;
|
|
if (array_key_exists('x_invoice_num', $_REQUEST)) $trxNum = db_escape_string($_REQUEST['x_invoice_num']);
|
|
$trx_num = $trxNum;
|
|
$invoice_num = $_REQUEST['x_invoice_num'];
|
|
$authorization_num = $_REQUEST['Authorization_Num'];
|
|
$response_code = $_REQUEST['x_response_code'];
|
|
$response_reason_text = $_REQUEST['x_response_reason_text'];
|
|
if (array_key_exists('bank_resp_code', $_REQUEST)) $bank_resp_code = db_escape_string($_REQUEST['Bank_Resp_code']);
|
|
$bank_message = $_REQUEST['Bank_Message'];
|
|
$method = $_REQUEST['x_method'];
|
|
$card_type = $_REQUEST['TransactionCardType'];
|
|
$currency_code = $_REQUEST['x_currency_code'];
|
|
$card_holders_name = $_REQUEST['CardHoldersName'];
|
|
$card_number = $_REQUEST['Card_Number'];
|
|
$authorization_num = $_REQUEST['Authorization_Num'];
|
|
$amount = str_replace(",","",$_REQUEST['x_amount']);
|
|
$surcharge = str_replace(",","",$_REQUEST['SurchargeAmount']);
|
|
$exact_ctr = $_REQUEST['exact_ctr'];
|
|
$exact_message = $_REQUEST['EXact_Message'];
|
|
$merchant_name = $_REQUEST['MerchantName'];
|
|
$merchant_country = $_REQUEST['MerchantCountry'];
|
|
$posting_result = 'Incomplete';
|
|
|
|
|
|
// Create entry in user_exact_transactions table
|
|
$trxFields = array('trx_result','trx_msg','invoice_num','response_code','response_reason_text','bank_resp_code','bank_message','method','card_type','currency_code','card_holders_name',
|
|
'card_number','authorization_num','exact_ctr','exact_message','merchant_name','merchant_country','trx_num','user_num','posting_result','posting_message');
|
|
$trxInsert = "school_num,posting_time,ptime,amount,surcharge";
|
|
$trxValues = "$school_num,'$time',$ptime,$amount,$surcharge";
|
|
for ($i = 0; $i < count($trxFields); $i++) {
|
|
$fieldName = $trxFields[$i];
|
|
$fieldValue = db_escape_string($$fieldName);
|
|
$trxInsert .= ",$fieldName";
|
|
$trxValues .= ",'$fieldValue'";
|
|
}
|
|
$trxSQL = "INSERT INTO user_exact_transactions ($trxInsert) VALUES ($trxValues)";
|
|
$contents .= "$trxSQL\n";
|
|
db_query($trxSQL);
|
|
$trxID = db_insert_id();
|
|
$contents .= "Insert ID: $trxID\n\n";
|
|
|
|
|
|
// Exit if transaction was not approved
|
|
if ($response_code != 1) {
|
|
$error_message = "Transaction not Approved";
|
|
$contents .= "$error_message\n\n";
|
|
saveOutput($contents);
|
|
header("Location: /exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
|
|
// Load school information from the database
|
|
$r = db_query("SELECT * FROM schools WHERE record_num = {$school_num}");
|
|
if (db_num_rows($r) != 1) {
|
|
$error_message = "Invalid school.";
|
|
$query = "UPDATE user_exact_transactions SET posting_result = 'Error', posting_message = 'Invalid school' WHERE record_num = $trxID";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
$contents .= "$error_message\n\n";
|
|
saveOutput($contents);
|
|
header("Location: /exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=" . urlencode($error_message));
|
|
exit();
|
|
} else {
|
|
extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 's');
|
|
|
|
if ($s_secure_certificate == 'Y') $URL = "https://$s_url";
|
|
else $URL = "http://$s_url";
|
|
|
|
if ($s_reseller != 'esns') {
|
|
$URL .= "/?form_message=".urlencode($trxMsg)."&error_message=";
|
|
}
|
|
else {
|
|
$URL .= "/exTransactionComplete.php?sn=$school_num&trxid=$trxID&error_message=";
|
|
}
|
|
}
|
|
|
|
|
|
// Use the posted transaction number value to get the post values from DB
|
|
$query = "SELECT * FROM user_online_payments WHERE record_num = {$trxNum}";
|
|
$contents .= "$query\n";
|
|
$r = db_query($query);
|
|
if (db_num_rows($r) > 0) {
|
|
extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 'PMTS');
|
|
$user_num = $PMTS_user_num;
|
|
}
|
|
else {
|
|
$error_message = "Unexpected payment - no matching pending payment";
|
|
$contents .= "$error_message\n\n";
|
|
saveOutput($contents);
|
|
header("Location: $URL" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
|
|
// Check if this entry is in the user_exact_transactions table
|
|
$query = "SELECT * FROM user_exact_transactions WHERE school_num = $school_num AND trx_num = $trx_num AND trx_result = '$trx_result' AND authorization_num = '$authorization_num' AND record_num != $trxID";
|
|
$contents .= "$query\n";
|
|
$r = db_query($query);
|
|
if (db_num_rows($r) > 0) {
|
|
$error_message = "Duplicate Posting - Transaction Has Already Been Processed: $trx_num";
|
|
$contents .= "$error_message\n\n";
|
|
saveOutput($contents);
|
|
header("Location: $URL" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
|
|
|
|
// Update hotlunch_orders table
|
|
$query = "SELECT hloh.* FROM hotlunch_order_header as hloh, people as p " .
|
|
"WHERE hloh.school_num = {$school_num} " .
|
|
"AND ordered_by_num = p.record_num " .
|
|
"AND p.user_num = {$user_num} " .
|
|
"AND hloh.status NOT IN ('Paid','Complimentary','Concession')";
|
|
$contents .= "$query\n";
|
|
$orders = db_query($query);
|
|
$contents .= "Orders Found: " . db_num_rows($orders) . "\n";
|
|
|
|
$today = date("Y-m-d",$ptime);
|
|
$order_payments = "";
|
|
$snum = 0;
|
|
if (db_num_rows($orders) > 0) {
|
|
while ($row = db_fetch_array($orders)) {
|
|
$onum = $row['record_num'];
|
|
$ototal = $row['order_total'];
|
|
$opaid = $row['amount_paid'];
|
|
$snum = $row['schedule_num'];
|
|
$amt = number_format($ototal - $opaid,2);
|
|
if (strlen($order_payments) > 0) $order_payments .= "|";
|
|
$order_payments .= "{" . $onum . ":" . $amt . "}";
|
|
|
|
$query = "UPDATE hotlunch_order_header " .
|
|
"SET amount_paid = order_total, " .
|
|
"status = 'Paid', " .
|
|
"paid_date = '$today', " .
|
|
"payment_method = 'On-Line Payment' " .
|
|
"WHERE record_num = {$onum}";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
$contents .= " - Order Paid: $onum\n";
|
|
}
|
|
}
|
|
|
|
$contents .= "\n";
|
|
|
|
|
|
// Update online_payments database table
|
|
$query = "UPDATE user_online_payments " .
|
|
"SET status = 'Paid', payment_amount = balance_owing, reference = '{$authorization_num}', trx_fee = 0, completed_time = $ptime " .
|
|
"WHERE record_num = $trxNum";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
|
|
// Post transaction to the user_account
|
|
date_default_timezone_set(mapTimeZone($s_timezone));
|
|
$entered_time = $ptime;
|
|
$trx_time = date("Y-m-d H:i:s",$entered_time);
|
|
|
|
// Post transaction fee if there is one
|
|
if ($PMTS_transaction_fee != 0) {
|
|
if ($PMTS_transaction_fee > 0) {
|
|
$query = "INSERT INTO user_account " .
|
|
"(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
|
|
"VALUES ($school_num,$user_num,$snum,'$trx_time','Credit Card Transaction Fee','Closed','',$PMTS_transaction_fee,$PMTS_transaction_fee,0,'Credit Card','$authorization_num',NULL,'N',$entered_time)";
|
|
}
|
|
else {
|
|
$query = "INSERT INTO user_account " .
|
|
"(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
|
|
"VALUES ($school_num,$user_num,$snum,'$trx_time','Transaction Credit','Closed','',$PMTS_transaction_fee,$PMTS_transaction_fee,0,'Credit Card','$authorization_num',NULL,'N',$entered_time)";
|
|
}
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
$entered_time += 1;
|
|
$trx_time = date("Y-m-d H:i:s",$entered_time);
|
|
}
|
|
|
|
// Insertpayment transaction
|
|
$amount = $amount * -1;
|
|
$query = "INSERT INTO user_account " .
|
|
"(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,payment_method,payment_reference,order_payments,deleted,entered_time,transaction_status) " .
|
|
"VALUES ($school_num,$user_num,$snum,'$trx_time','Payment','On-Line Payment',$amount,'$method','$authorization_num','$order_payments','N',$entered_time,'Closed')";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Update any open charge transactions
|
|
$query = "UPDATE user_account SET payment_method = '$method', payment_reference = '$authorization_num', payment_time = $entered_time " .
|
|
"WHERE school_num = $school_num AND user_num = $user_num AND transaction_status = 'Open' AND transaction_amount > 0";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Close all transactions
|
|
$query = "UPDATE user_account SET transaction_status = 'Closed' WHERE school_num = $school_num AND user_num = $user_num";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Update all orders to set amount paid
|
|
$query = "UPDATE user_account SET amount_paid = transaction_amount WHERE school_num = $school_num AND user_num = $user_num AND transaction_amount > 0";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
|
|
// Make activity_log entry
|
|
$username = db_getVal("SELECT userid FROM users WHERE school_num = $school_num AND record_num = $user_num");
|
|
$activity = "On-Line Payment";
|
|
if (!isset($trx_num)) $trx_num = '';
|
|
$additional_info = "TRX ID: $trx_num\nAmount: " . number_format(abs($amount),2) . "\n";
|
|
$curr_time = $ptime;
|
|
$activity_datetime = date("Y-m-d H:i:s",$curr_time);
|
|
$uid = db_escape_string($username);
|
|
$query = "insert into activity_log (school_num,userid,user_ip,activity_time,activity_datetime,activity,information) " .
|
|
"values($school_num,'$uid','0.0.0.0',$curr_time,'$activity_datetime','$activity','$additional_info')";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Reset user transaction status
|
|
$query = "update users set trx_status = NULL where school_num = $school_num and record_num = $user_num";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Reset user can_order flag
|
|
$query = "update users set can_order = 'Yes' where school_num = $school_num and can_order = 'Balance' and record_num = $user_num";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
|
|
// Update user_exact_transactions
|
|
$query = "UPDATE user_exact_transactions SET posting_message = 'Payment processed ok', posting_result = 'Posted' WHERE record_num = $trxID";
|
|
$contents .= "$query\n";
|
|
db_query($query);
|
|
$contents .= "Payment processed ok\n\n\n";
|
|
|
|
adjustUserAccountDetails($user_num,$school_num);
|
|
|
|
saveOutput($contents);
|
|
header("Location: $URL" . urlencode($error_message));
|
|
|
|
?>
|