403 allways on payment notifcation

Hello,

So every time we receive a notification from Worldpay it is html encoded so :

https%3A%2F%2Fwww.mysite.co.uk%2Findex.php%3Foption%3Dcom_hikashop%26ctrl%3Dcheckout%26task%3Dnotify%26notif_payment%3Dbf_rbsbusinessgateway%26tmpl%3Dcomponent%26componentStyle%3Dcommon%26lang%3Den&authMode=A&instId=1000552&displayAddress=myaddres&AAV=00000&testMode=0&name=Home&callbackPW=cb_pw&region=&AVS=2222&desc=mydescription&authAmountString=%26%23163%3B8.19

index.php?option=com_hikashop&ctrl=checkout&task=notify¬if_payment=bf_rbsbusinessgateway&tmpl=component&componentStyle=common&lang=en&authMode=A&instId=1000552&displayAddress=myaddress&AAV=00000&testMode=0&name=Home&callbackPW=cb_pw®ion=&AVS=2222&desc=mydescription&authAmountString=£8.19

index.php?option=com_hikashop&ctrl=checkout&task=notify&notif_payment=bf_rbsbusinessgateway&tmpl=component&componentStyle=common&lang=en&authMode=A&instId=1000552&displayAddress=myaddress&AAV=00000&testMode=0&name=Home&callbackPW=cb_pw®ion=&AVS=2222&desc=mydescription&authAmountString=£8.19

Hello Jerome,

As explained this is the issue. Server Raw access logs show:

0.0.0.0 - - [24/Apr/2017:09:00:33 +0100] "GET /index.php?option=com_hikashop&ctrl=checkout&task=notify%C2%ACif_payment=bf_rbsbusinessgateway&componentStyle=common&lang=en&authMode=A&instId=1000552&displayAddress=1%20MyAddress%20House,%20City&AAV=00000&testMode=0&name=Doris%20Joe&callbackPW=My_Call_back_password%C2%AEion=&AVS=2222&desc=&authAmountString=%C2%A360.18 HTTP/1.1" 403 2108 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.68 Safari/537.36"

As you can see, worldpay is using encoding on the callback url. which in turn encodes ¬ as %C2%AC

Given you say ¬ has nothing to do with the issue, yet it is the core issue here. replacing %C2%AC with ¬ in the request allows it to proceed. But we cannot control how worldpay is handling the encoding.

Many thanks

Hello Jerome,

Thank you and It was me with has recently upgraded the hikashop plugin for the additional options. You might want to get Nicolas to look through this post.

As stated it is because the way hikashop adds the query string:

¬ into the url. Worldpay encode the url on return which is quite standard practice when returning and keeping the url entact for each:

echo urlencode('&not');
		echo urldecode('%26not');

Currently trying to encode the return url before going to worldpay. Will run some tests and report back.

This has reared its ugly head again. I suspect this is why we are not authenticating PayPals IPN's and they come back with invalid transaction. Since our notification logged url is:

option=com_hikashop&ctrl=checkout&task=notify¬if_payment=paypal&tmpl=component&componentStyle=common&lang=en&Itemid=206&mc_gross=8.19&invoice=1054&

further down it is has: &mc_fee=0.48¬ify_version=3.8&

So I've done some code to try and remove it and will wait for a test user to come through.