skip address validation in webhook (#254)

* version bump to 3.6.1

CHANGELOG.md

@@ -1,7 +1,15 @@
 
 # Change Log
 
+
+## [3.6.0] - 2021-06-17
 
+### Changed
+### Fixed
+- [Signature issue, billing address validation](https://github.com/razorpay/razorpay-magento/pull/254).
+
+ Fixed webhook signature mismatch issue and added validation for shipping/billing address and shipping method for quote, before creating RZP order.
+
 ## [3.6.0] - 2021-06-11
 
 ### Added

Controller/Payment/Order.php

@@ -164,6 +164,10 @@ public function execute()
         }
         else
         {
+            //validate shipping and billing
+            $validationSuccess =  true;
+            $code = 200;
+
             if(empty($_POST['email']) === true)
             {
                 $this->logger->info("Email field is required");
@@ -173,9 +177,44 @@ public function execute()
                     'parameters' => []
                 ];
 
-                $code = 200;
+                $validationSuccess = false;
             }
-            else
+
+            if(empty($this->getQuote()->getBillingAddress()->getPostcode()) === true)
+            {
+                $responseContent = [
+                    'message'   => "Billing Address is required",
+                    'parameters' => []
+                ];
+
+                $validationSuccess = false;
+            }
+
+            if(!$this->getQuote()->getIsVirtual())
+            {
+                 //validate quote Shipping method
+                if(empty($this->getQuote()->getShippingAddress()->getShippingMethod()) === true)
+                {
+                    $responseContent = [
+                        'message'   => "Shipping method is required",
+                        'parameters' => []
+                    ];
+
+                    $validationSuccess = false;
+                }
+
+                if(empty($this->getQuote()->getShippingAddress()->getPostcode()) === true)
+                {
+                    $responseContent = [
+                        'message'   => "Shipping Address is required",
+                        'parameters' => []
+                    ];
+
+                    $validationSuccess = false;
+                }
+            }
+
+            if($validationSuccess)
             {
                 $amount = (int) (number_format($this->getQuote()->getGrandTotal() * 100, 0, ".", ""));
 

Controller/Payment/Webhook.php

@@ -414,6 +414,10 @@ protected function getQuoteObject($post, $quoteId)
             $quote->setCustomerIsGuest(true);
         }
 
+        //skip address validation as some time billing/shipping address not set for the quote
+        $quote->getBillingAddress()->setShouldIgnoreValidation(true);
+        $quote->getShippingAddress()->setShouldIgnoreValidation(true);
+
         $quote->setStore($store);
 
         $quote->collectTotals();

Model/PaymentMethod.php

@@ -450,7 +450,9 @@ public  function validateWebhookSignature(array $post)
     {
         $webhookSecret = $this->config->getWebhookSecret();
 
-        $this->rzp->utility->verifyWebhookSignature(json_encode($post), $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'], $webhookSecret);
+        $postData = file_get_contents('php://input');
+
+        $this->rzp->utility->verifyWebhookSignature($postData, $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'], $webhookSecret);
     }
 
     protected function getPostData()

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "razorpay/magento",
     "description": "Razorpay Magento 2.0 plugin for accepting payments.",
-    "version": "3.6.0",
+    "version": "3.6.1",
     "require": {
         "php": "~5.5.0|~5.6.0|^7.0",
         "razorpay/razorpay": "2.*"

etc/module.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
-    <module name="Razorpay_Magento" setup_version="3.6.0">
+    <module name="Razorpay_Magento" setup_version="3.6.1">
 	    <sequence>
 	        <module name="Magento_Sales" />
 	        <module name="Magento_Payment" />