Session cookies getting 'lost' when payment portal process completes - php

I have recently taken over the running of a hotel website which is linked to a bespoke booking management system. Because of this, it was simpler to leave all the previous developer's PHP code in place on the booking and payment pages of the website (The site uses stripe.com to process payments)
When a payment is processed, a PHP script is used to create a number of session cookies to record things like Room Number, Booking REF Cost etc then the site enters the Stripe portal which picks up the cookies and processes the payment - this is where things seem to go wrong.
The payment is processed successfully, all the info is displayed on the Stripe screen so I know it's reaching their server however when the browser is the forwarded back to the payment successful page on my new site, all the information stored by the cookies seems to vanish so the confirmation page fields are all blank.
Just to reiterate, this is code which was used on the old site for several years and which is still working on that site now (it's still live) - the info only disappears when Stripe returns to my new site.
So far as I can see, the PHP is identical on old and new sites. The only major differences are the domain hosting the old and new site are different (the new site is on our testing server) and obviously the servers are different.
The version of PHP used by the old site is 5.6 which I know is deprecated however I'm paying our hosting company (IONOS) £7.99 per month to enable support for this version and everything to this point has worked fine.
I've talked to Stripe support (useless) in case it was a security issue linked to the new testing server domain needing to be registered with them - they say it isn't. I'm hoping I don't get a succession of 'upgrade to the latest version of PHP' comments on here - we will do that eventually but it's so close to being done - this is one of the final tasks.

Related

Wordpress Paid Membership Pro not adding user to members list on checkout

I have been trying to configure a PMPro/Buddypress site for a few days now and I am having issues with PMPro. When I complete the checkout process the user gets added to the wp_users table, but is not added to the wp_pmpro_membership_users table, which means that a user does not have access to BuddyPress until their user level is updated manually by the admin user.
How can I have the user added automatically to the wp_pmpro_membership_users table upon successful signup?
But to answer the question:
The payment/member workflow was failing because my local dev machine doesn't have SSL. The payment looked like it processing fine in Stripe, yet there was no indicator from the plugin (or elsewhere) that it was failing due to lack of SSL.
Once SSL was enabled, it worked as expected.

Changes on my website are not reflected quickly

Cache issue or something else I am failing to understand.
Since last two weeks I am facing a bizarre condition not only on my website but also my API written for mobile app.
The problem is changes I am making on my website are not reflected quickly. It's taking a lot of time, same goes for my mobile API.
For example: If I delete any item from my app that item is deleted from my database but it's still showing in my item list. After refreshing 100's of time it stop showing.
I made my web app and API using codeigniter 3 and I am hosting my website on bluehost server.

PHP does not work properly in Android WebView

I created a simple app in android studio using WebView. The WebView element connected to a mobile website. When I login, some sessions like user and id are created to make the app work properly. Depending on the values of these sessions, information in a list is shown. But, when I login to the mobile application using the same credentials, it looks like some of the sessions are not created. When I echo'ed the sessions, they are simply not shown.
Some time ago I faced this problem too. Because I had to design the list-items, I hardcoded them. When I finished designing them, I replaced the hardcoded with the old function, and it worked! For a short time tho, after rebooting my device the old problem (as described) appeared again.

server sent events - One client to update them all

Alright, so here is what I am trying to achieve. I have a custom built Point of Sale done in VB.net. What I want to add now is a customer facing android tablet that shows the reciept as it's entered into the Point of Sale.
Brainstorming how to do this I came up with the idea to use a php hosted script (no problem as the POS has a mysql-php web backend on a local server) that would use server sent events to update the tablet. The issue I'm facing is I'm not sure how to update the server (and thus the tablet) from another client (this one being the Point of Sale).
I can't seem to find any examples other than clocks for server sent events, does anyone have a link to something similar or perhaps a better solution than what I came up with?
I had considered using an app like idisplay and just extending that way, but it doesn't support windows 8 which is what the POS is running. I also considered websockets, but I don't have a firm enough grasp of that to get it up and running. I could make an app for the tablet, but I don't really want to do that, most of my background with app development is on iOS and I don't personally like java as a development language.
EDIT 1: Alright, so I'm understanding better how I would need to make this work.
So far I have it working where I can input a $_GET variable to change the value and the next time an update is pushed it works properly. I just need to verify there's new or different data before it pushes the data.
Is there a better example than this http://www.html5rocks.com/en/tutorials/eventsource/basics/ concerning how to push updates on demand to the listening clients?

Persistent login info from server to server

I am currently working on 2 web servers, One Coldfusion and the other PHP.
Right now, the Coldfusion server is my main server where users log in to access restricted data.
However, I have also begun using a PHP server and want to make it transparent for users to access a specific page on that server - that server requires log in information as well.
I do not want the users to log in twice.
Is there a way to accomplish this ?
Thx
UPDATE: Working in an Intranet environment, so I can't use any public solution.
UPDATE: Reason I am asking for this is because we are moving from a MSQL / Coldfusion environment (Initial server) to a PHP / ORACLE (new server). So I have 2 user tables as well (although they contain mostly the same information).
I am trying to faze out the use of our initial server in favor of our new server transparently to the user and thus I have to work in parallel for the time being.
Most single-sign-on solutions work a bit like this...
Main system authenticates use
User opts initiates a need to move to system 2
Main system authenticates the user with system 2 in the background
System 2 supplies a random, long and disposable token to Main system
Main system redirects the user, with the token, to system 2
System 2 checks the token (and other factors such as IP address) to validate the session
System 2 disposes of the token to ensure it can't be replayed
You would want to ensure that the transmission channels had some security on, especially where Main system and system 2 are talking to each other. You would want that to be a secure transport.
Store sessions in a database, and share them between the two apps.
You could use xml-rpc to get user data and log the user into the other site when they have a login cookie for the first one and vice versa.
Php manual page for XML-rpc
Here is what I have done, in running my own game server, had users on sql server, and on mysql, and wanted to integrate them both.
I made sure that if a user was created on 1 system, was also created on the other.
So you can modify code in both applications, to automatically create a user in other system if it is created on here.
Depending if both servers share a domain, can you do cross-domain sessions or cookies...But my best guess is to store and retreive data...
Or..
as a person logins/registers record their current ip address, on both servers, then check if this person was on the other server within 2-5 minutes, if so, use the ip address to identify them....
This system is tricky because timing is important, so your not leaving a huge hole in your security....But for short term, going between servers, this is simplest solution, in my own opinion.
Good Luck.
If you are on an intranet, you can actually sniff out the network username of the user from the PC they are logged into the network on using PHP. This assumes that:
You are using IIS to host your PHP application.
Your users are using Windows.
Check the section "2.2 Enabling Support for Detecting Usernames" here.
After that, all you need to do is investigate if the same is possible from Coldfusion, and you have the basis of an SSO solution based on the network usernames.
How about implementing an OpenID solution, much like the one apparent on StackOverflow?
You may benefit from dropping a shared object on the client machine via Flash or Flex. This object could then be read from ColdFusion/PHP/Python on servers that otherwise had no connection to each other or access to a common database.
Here is a simple example from the Adobe Docs
Maintain local persistence. This is
the simplest way to use a shared
object, and does not require Flash
Media Server. For example, you can
call SharedObject.getLocal() to create
a shared object in an application,
such as a calculator with memory. When
the user closes the calculator, Flash
Player saves the last value in a
shared object on the user's computer.
The next time the calculator is run,
it contains the values it had
previously. Alternatively, if you set
the shared object's properties to null
before the calculator application is
closed, the next time the application
runs, it opens without any values.
Another example of maintaining local
persistence is tracking user
preferences or other data for a
complex website, such as a record of
which articles a user read on a news
site. Tracking this information allows
you to display articles that have
already been read differently from
new, unread articles. Storing this
information on the user's computer
reduces server load.
Full Information: http://livedocs.adobe.com/flex/3/langref/flash/net/SharedObject.html

Categories