Hash message Rails

Question

I have issues linking my Rails app to Paybox (through a French bank).

The technical support says that the problem could come from the hash message i'm sending to them (through a form). But they have no knowledge about Ruby so they can't guarantee anything.

Maybe some of you will find something wrong?

Here is the method:

def paiement
    @commande = Commande.find_by(code: params[:id])

    @confirmation_url = ENV['PBX_EFFECTUE'].gsub('CODE_COMMANDE', @commande.code)
    @annulation_url = ENV['PBX_ANNULE'].gsub('CODE_COMMANDE', @commande.code)
    @refus_url = ENV['PBX_REFUSE'].gsub('CODE_COMMANDE', @commande.code)

    @current_time = Time.now.strftime('%FT%T%:z')

    msg = {
      PBX_SITE: "#{ENV['PBX_SITE']}",
      PBX_RANG: "#{ENV['PBX_RANG']}",
      PBX_IDENTIFIANT: "#{ENV['PBX_IDENTIFIANT']}",
      PBX_TOTAL: "#{@commande.total_price_centimes}",
      PBX_DEVISE: "978",
      PBX_CMD: "#{@commande.code}",
      PBX_PORTEUR: "#{current_user.email}",
      PBX_REPONDRE_A: "#{ENV['PBX_REPONDRE_A']}",
      PBX_RETOUR: "#{ENV['PBX_RETOUR']}",
      PBX_EFFECTUE: "#{@confirmation_url}",
      PBX_ANNULE: "#{@annulation_url}",
      PBX_REFUSE: "#{@refus_url}",
      PBX_HASH: "SHA512",
      PBX_TIME: "#{@current_time}"
    }

    key = ENV['CLE_HMAC']
    binKey = [key].pack('H*')

    digest = OpenSSL::Digest.new('sha512')
    @signature = OpenSSL::HMAC.hexdigest(digest, binKey, msg.keys.map{|k,v| "#{k}=#{v}"}.join('&')).upcase
    #binding.pry
  end

The form:

<form method="POST" action="<%= ENV['CREDIT_AGRICOLE_URL'] %>" id="paiement-form">
  <input type="hidden" name="PBX_SITE" value="<%= ENV['PBX_SITE'] %>">
  <input type="hidden" name="PBX_RANG" value="<%= ENV['PBX_RANG'] %>">
  <input type="hidden" name="PBX_IDENTIFIANT" value="<%= ENV['PBX_IDENTIFIANT'] %>">
  <input type="hidden" name="PBX_TOTAL" value="<%= @commande.total_price_centimes %>">
  <input type="hidden" name="PBX_DEVISE" value="978">
  <input type="hidden" name="PBX_CMD" value="<%= @commande.code %>">
  <input type="hidden" name="PBX_PORTEUR" value="<%= ENV['PBX_PORTEUR'] %>">
  <input type="hidden" name="PBX_REPONDRE_A" value="<%= ENV['PBX_REPONDRE_A'] %>">
  <input type="hidden" name="PBX_RETOUR" value="<%= ENV['PBX_RETOUR'] %>">
  <input type="hidden" name="PBX_EFFECTUE" value="<%= @confirmation_url %>">
  <input type="hidden" name="PBX_ANNULE" value="<%= @annulation_url %>">
  <input type="hidden" name="PBX_REFUSE" value="<%= @refus_url %>">
  <input type="hidden" name="PBX_HASH" value="SHA512">
  <input type="hidden" name="PBX_TIME" value="<%= @current_time %>">
  <input type="hidden" name="PBX_HMAC" value="<%= @signature %>">
  <input type="submit" value="Envoyer">
</form>

Where the paiement action is triggered:

<div class="cmd-actions">
    <%= form_for @commande, {url: commande_path(@commande.code)} do |f| %>
      <div class="recap-commande-container">
        <div class="etape">
          <div>3</div>
          <h1>Récapitulatif et paiement de votre commande</h1>
        </div>
        <%= render partial: 'line_items_table', locals: {recap_commande: @commande} %>
      </div>
      <div id="secured-paiement">
        <div>
          <h3>Choisissez votre mode de paiement :</h3>
        </div>
        <div class="secured-paiement-logo">
          <div class="paiement-row">
            <div class="input-radio">
              <%= radio_button_tag("commande[methode_paiement]", 'carte_bancaire', {onchange: 'methode(1)', data: {a: "carte_bancaire"}, id: 'carte_bancaire'}) %>
            </div>
            <div class="input-img">
              <%= image_tag('logo/ca-e-transactions', style: 'width: 170px;height: 40px') %>
              <%= image_tag('logo/mastercard', style: 'width: 50px;height: 40px') %>
              <%= image_tag('logo/visa', style: 'width: 50px;height: 40px') %>
              <%= image_tag('logo/cb', style: 'width: 50px;height: 40px') %>
            </div>
          </div>
          <div class="paiement-row" style="margin-top: 20px;">
            <div class="input-radio">
              <%= radio_button_tag("commande[methode_paiement]", 'le_pot_commun', {onchange: 'methode(2)', data: {a: "le_pot_commun"}, id: 'le_pot_commun'}) %>
            </div>
            <div class="input-img">
              <%= image_tag('logo/pot-commun') %>
            </div>
          </div>
        </div>
      </div>
      <div id="proceed-actions">
        <div id="cgv">
          <%= check_box_tag "cgv" %>
          <label>J'accepte les <%= link_to "conditions générales de vente", conditions_generales_de_vente_path, style: 'color:black', target: 'blank' %></label>
        </div>
      </div>
      <div class="commander-link" id="paiement-cmd-btn">
        <%= f.submit "Payer ma commande" %>
      </div>
    <% end %>
  </div>

The form is supposed to redirect to https://preprod-tpeweb.paybox.com/cgi/MYchoix_pagepaiement.cgi, and this is what it does. But on that same page, i have the following error message: "Problème d'identification du commerce. Accès refusé !" ('Authentification issue. Access denied !').

This issue is related to this one: Ruby HMAC signing issue

Any ideas?

codebases in local language is really weird. When is the `paiement` action triggered? — apneadiving, Feb 07 '18 at 15:02

Cody Caughlan · Answer 1 · 2018-02-07T16:43:58.767

0

Usually with HMAC signatures the keys are sorted alphabetically first prior to be signed. If you are iterating over a Hash key/value pairs then the iteration order is largely non-deterministic (or should at least be treated as such).

Try sorting your keys first like:

msg.keys.sort.map{|k| "#{k}=#{msg[k]}"}

edited Feb 07 '18 at 16:43

answered Feb 07 '18 at 15:27

Cody Caughlan

32,456
5
63
68

score 0 · Answer 2 · answered Feb 07 '18 at 16:00

0

It seems you made a typo in collecting the data from your hash. You currently use:

msg.keys.map { |k,v| "#{k}=#{v}" }.join('&')

but by calling #keys on the hash you'll get an array with only keys.

I guess you meant to type

msg.map { |k,v| "#{k}=#{v}" }.join('&')

otherwise you'll lose the values and v is always nil.

answered Feb 07 '18 at 16:00

3limin4t0r

19,353
2
31
52

Thanks Johan, but unfortunately it doesn't solve the problem either... :( – justinedps26 Feb 07 '18 at 16:19

Raffy · Answer 3 · 2018-02-15T21:22:50.123

0

For the date I'm using

 @date_time = Time.now.iso8601

To create Hmac:

bin_key = Array(keyTest).pack 'H*'
@hmac = OpenSSL::HMAC.hexdigest("SHA512", bin_key, data).upcase

Also your key needs to be activated after being generated.

edited Feb 15 '18 at 21:22

answered Feb 15 '18 at 21:10

Raffy

79
4

i've tried with your code but it still doesn't work.. :( – justinedps26 Feb 18 '18 at 14:57

Hash message Rails

3 Answers3