problem with encrypting dynamic “add to cart” paypal button with php

Question

I Built a simple payment system integrating paypal with wordpress in php basically I build a list where each list item retrieves metadata from a specific page in wordress (a page for every product) and with this data build dynamically an "add to cart" paypal button. this worked fine. but.. Then I tried to encrypt the "add to cart" button for obvious reasons, I found a php program thats supposed to do that (and from what I see in different internet forums - most of the time delivers to this promise), and I think I followed all of paypal instructions with the certificate (private, public. paypals etc..)

While I don't get any error from the html page - when I push the add to cart button I get a paypal error: "We have detected a problem with this shopping cart. If the problem persists, please contact the merchant." but I don't have any details why and what I'm doing wrong..

I have a merchant account with paypal.

In order to remove unnecessary clutter and noise I built a test page with static data to check if the button works right and here it is: glad for any help

the basic test page:

<?php
include_once "testfunctions.php";
//inserting some test data
$themetacost='100';
$themetaname="testbook";
$themetashipping='20';
//building the paypal button
$line='';
$line.='<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" id="payform" >
            <input type="hidden" name="cmd" value="_cart">
                        <input type="hidden" name="encrypted" value="';
$line.= buildbutton($themetacost,$themetaname,$themetashipping);
$line.='">';
$line.='<input type="image" src="https://www.paypalobjects.com/WEBSCR-640-20110429-1/he_IL/i/btn/btn_cart_SM.gif" border="0" name="submit" alt="PayPal - הדרך הקלה והבטוחה לשלם באופן מקוון!">
                <img alt="" border="0" src="https://www.paypalobjects.com/WEBSCR-640-20110429-1/he_IL/i/scr/pixel.gif" width="1" height="1">
                </form><br/>';
echo $line;

?>

the php buildbutton and encrypting functions:

<?php
function buildbutton($amount,$bname,$shipping) {
//Sample PayPal Button Encryption: Copyright 2006-2010 StellarWebSolutions.com
//Not for resale  - license agreement at
//http://www.stellarwebsolutions.com/en/eula.php
//Updated: 2010 02 01



$form = array('cmd' => '_cart',
        'business' => 'X@XXX.CO.il', // changed from the original
        'cert_id' => 'XXXXXXXXXXX',// changed from the original
    'shipping' => $shipping,
        //'invoice' => '', //check what this is
        'currency_code' => 'ILS',
        //'no_shipping' => '0', //refers to shipping address
        'add'=>'1',
    'item_name' => $bname,
    'amount' => $amount
    );


    $encrypted = paypal_encrypt($form); 

return $encrypted;
}
function paypal_encrypt($hash)
{
    //Sample PayPal Button Encryption: Copyright 2006-2010 StellarWebSolutions.com
    //Not for resale - license agreement at
    //http://www.stellarwebsolutions.com/en/eula.php
    # private key file to use //

$MY_KEY_FILE = "/home/paypal/my-prvkey.pem";
# public certificate file to use
$MY_CERT_FILE = "/home/paypal/my-prvkey.pem";// 

# Paypal's public certificate
$PAYPAL_CERT_FILE = "/home/paypal/paypal_cert.pem";

# path to the openssl binary
$OPENSSL = "/usr/bin/openssl";

    if (!file_exists($MY_KEY_FILE)) {
        echo "ERROR: MY_KEY_FILE $MY_KEY_FILE not found\n";
    }
    if (!file_exists($MY_CERT_FILE)) {
        echo "ERROR: MY_CERT_FILE $MY_CERT_FILE not found\n";
    }
    if (!file_exists($PAYPAL_CERT_FILE)) {
        echo "ERROR: PAYPAL_CERT_FILE $PAYPAL_CERT_FILE not found\n";
    }
        if (!file_exists($OPENSSL)){
                echo "error with openssl $OPENSSL not found \n";
        }


    //Assign Build Notation for PayPal Support
    //$hash['bn']= 'StellarWebSolutions.PHP_EWP2'; //this is not needed cause i dont have a ewp

    $data = "";
    foreach ($hash as $key => $value) {
        if ($value != "") {
            //echo "Adding to blob: $key=$value\n";
            $data .= "$key=$value\n";
        }
    }

    $openssl_cmd = "($OPENSSL smime -sign -signer $MY_CERT_FILE -inkey $MY_KEY_FILE " .
                        "-outform der -nodetach -binary <<_EOF_\n$data\n_EOF_\n) | " .
                        "$OPENSSL smime -encrypt -des3 -binary -outform pem $PAYPAL_CERT_FILE";

    exec($openssl_cmd, $output, $error);

    if (!$error) {
        return implode("\n",$output);
    } else {
        return "ERROR: encryption failed";
    }
}

?>

I tried to change the variables to numbers to check if the problem is there that didn't help.

and this is how the encrypted test page source looks like:

action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank" id="payform" >

            <input type="hidden" name="cmd" value="_cart">

                        <input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----
MIIBdwYJKoZIhvcNAQcDoIIBaDCCAWQCAQAxggEwMIIBLAIBADCBlDCBjjELMAkG
A1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw
EgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UE
AxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQAwDQYJ
KoZIhvcNAQEBBQAEgYAiFKR0WuQJcr6cQZvDCptQeDNyfipH9pDy1Q58C+ITCZWY
XRkkUOvvL3jniO1GUxsY2JleGAdZWSV1qgnO3uNjj0V3Z0AxbrAiuA0lLd8pscBT
MM+9+1RwjTOUVtOi3PASy1TC4hk6Wq01KUk1DCpbqMtqBZ6sWb5jHRxWqbL08zAr
BgkqhkiG9w0BBwEwFAYIKoZIhvcNAwcECClgCVLJPeXAgAgr8wXDhqI+og==
-----END PKCS7-----"><input type="image" src="https://www.paypalobjects.com/WEBSCR-640-20110429-1/he_IL/i/btn/btn_cart_SM.gif" border="0" name="submit" alt="PayPal - äãøê ä÷ìä åäáèåçä ìùìí áàåôï î÷ååï!">

                <img alt="" border="0" src="https://www.paypalobjects.com/WEBSCR-640-20110429-1/he_IL/i/scr/pixel.gif" width="1" height="1">

                </form><br/>

edit:after changing in the html form (not: the php encrypt function) from '_cart' to '_s-xclick' I get a different error:

The email address for the business is not present in the encrypted blob. Please contact your merchant.

following more advice in various paypal forums I also tried to renew the certificates and keys (all three of them..). didn't help at all!

Answer 1

I'd change the cmd to _s-xclick. All PayPal encrypted payments use this command.

When I tried it I got "The email address for the business is not present in the encrypted blob. Please contact your merchant." error. Have you tried the "Secure Merchant ID" instead of the email? It's in the account's profile.

Personally I'd recommend using the button manager APIs instead of the encrypted buttons. https://merchant.paypal.com/us/cgi-bin/?cmd=_render-content&content_ID=developer/e_howto_api_ButtonMgrAPIIntro its major advantage is you can call the API to retrieve the contents of the button. The encrypted blob can't really be decrypted to see if the email is actually there.

I hope this helps. Lorefold

Answer 2

Check if OpenSSL version is changed or certificates have issue.

You can refer Paypal to re generate the certificates an upload them to Paypal.