sphere/process_response.php

   1 <?php
   2
   3 /**
   4  * process_response.php
   5  *
   6  * Receives the middleman (initial_response.php) script from Sphere to avoid cross origin breakage.
   7  * Csrf prevention is maintained.
   8  * Works in both core and portal.
   9  *
  10  * @package   OpenEMR
  11  * @link      http://www.open-emr.org
  12  * @author    Brady Miller <brady.g.miller@gmail.com>
  13  * @copyright Copyright (c) 2021 Brady Miller <brady.g.miller@gmail.com>
  14  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  15  */
  16
  17 // Will start the (patient) portal OpenEMR session/cookie.
  18 require_once(__DIR__ . "/../src/Common/Session/SessionUtil.php");
  19 OpenEMR\Common\Session\SessionUtil::portalSessionStart();
  20
  21 $isPortal = false;
  22 if (isset($_SESSION['pid']) && isset($_SESSION['patient_portal_onsite_two'])) {
  23     $pid = $_SESSION['pid'];
  24     $ignoreAuth_onsite_portal = true;
  25     $isPortal = true;
  26     require_once(__DIR__ . "/../interface/globals.php");
  27 } else {
  28     OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
  29     $ignoreAuth = false;
  30     require_once(__DIR__ . "/../interface/globals.php");
  31 }
  32
  33 use OpenEMR\Common\Crypto\CryptoGen;
  34 use OpenEMR\Common\Csrf\CsrfUtils;
  35 use OpenEMR\Core\Header;
  36 use OpenEMR\PaymentProcessing\PaymentProcessing;
  37
  38 if (!CsrfUtils::verifyCsrfToken($_GET["csrf_token"], 'sphere')) {
  39     CsrfUtils::csrfNotVerified();
  40 }
  41
  42 if ($GLOBALS['payment_gateway'] != 'Sphere') {
  43     die(xlt("Feature not activated"));
  44 }
  45 ?>
  46
  47 <html>
  48 <head>
  49     <?php
  50     Header::setupHeader('opener');
  51
  52     $auditData = ['get' => $_GET, 'post' => $_POST];
  53
  54     if ($_GET['front'] == 'patient') {
  55         // will not show error descriptions in patient front
  56         $description = '';
  57     } else { // $_GET['front'] == 'clinic-phone' || $_GET['front'] == 'clinic-retail'
  58         $description = (!empty($_POST['description'])) ? ' (' . $_POST['description'] . ')' : '';
  59     }
  60
  61     if (!empty($_GET['cancel']) && ($_GET['cancel'] == 'cancel')) {
  62         PaymentProcessing::saveAudit('sphere', $_GET['patient_id_cc'], 0, $auditData, $_POST['ticket']);
  63         echo "<script>opener.sphereNotSuccess(" . xlj("Transaction Cancelled") . ");dlgclose();</script>";
  64     } elseif (($_POST['status_name'] == 'baddata') || ($_POST['status_name'] == 'error')) {
  65         PaymentProcessing::saveAudit('sphere', $_GET['patient_id_cc'], 0, $auditData, $_POST['ticket'], $_POST['transid'] ?? null, $_POST['action_name'] ?? null, $_POST['amount'] ?? null);
  66         echo "<script>opener.sphereNotSuccess(" . js_escape(xl("Transaction Error") . $description) . ");dlgclose();</script>";
  67     } elseif ($_POST['status_name'] == 'decline') {
  68         PaymentProcessing::saveAudit('sphere', $_GET['patient_id_cc'], 0, $auditData, $_POST['ticket'], $_POST['transid'], $_POST['action_name'], $_POST['amount']);
  69         echo "<script>opener.sphereNotSuccess(" . js_escape(xl("Transaction Declined") . $description) . ");dlgclose();</script>";
  70     } elseif ($_POST['status_name'] == 'approved') {
  71         // Success!
  72         PaymentProcessing::saveAudit('sphere', $_GET['patient_id_cc'], 1, $auditData, $_POST['ticket'], $_POST['transid'], $_POST['action_name'], $_POST['amount']);
  73         if ($_GET['front'] == 'patient') {
  74             echo "<script>opener.sphereSuccess(" . js_escape((new CryptoGen())->encryptStandard(json_encode($auditData))) . ");dlgclose();</script>";
  75         } else { // $_GET['front'] == 'clinic-phone' || $_GET['front'] == 'clinic-retail'
  76             echo "<script>opener.sphereSuccess(" . js_escape($_POST['transid']) . ");dlgclose();</script>";
  77         }
  78     } else {
  79         PaymentProcessing::saveAudit('sphere', $_GET['patient_id_cc'], 0, $auditData, $_POST['ticket'], $_POST['transid'] ?? null, $_POST['action_name'] ?? null, $_POST['amount'] ?? null);
  80         echo "<script>opener.sphereNotSuccess(" . js_escape(xl("Transaction Not Successful") . $description) . ");dlgclose();</script>";
  81     }
  82     ?>
  83 </head>
  84 <body>
  85 </body>
  86 </html>