Users are being redirected to sessions of other users

------=_NextPart_000_0001_01D8F032.8363DAA0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi, i am sorry, it's not clear which mailaddress I need to use, nor do I
know if this is the correct way to ask a question.

Kind regards, Jan Willem Vermeer

 

Van: [email protected] <[email protected]> 
Verzonden: donderdag 3 november 2022 14:07
Aan: '[email protected]' <[email protected]>
Onderwerp: Users are being redirected to sessions of other users

 

Hi, 

 

I have a major issue in the PHP connection between my application
PLANMYSPORT and the internet payment provider MOLLIE and hope you can give
me a clue.

 

Our customers send their invoices by mail with PLANMYSPORT. In every invoice
there is a link to pay online with MOLLIE. That link directs to the
php-script below.

 

This problem can occur:

1.	User A is on computer A with a unique session-id.
2.	User B is on computer B with a unique session-id.
3.	User A clicks on the link in the invoice. The logging shows that the
$paymentUrl is unique.
4.	User B clicks on the link in the invoice at exactly the same time.
The logging shows that B gets another unique $paymentUrl.
5.	User A is being redirected to the payment page for his transaction.
6.	User B is also (!) redirected to the payment page for user A.
7.	User B does not verify the amount and invoice id on the payment
screen and pays the invoice of user A.

 

Step 6 is wrong offcourse: user B should be redirected to his own payment
page and never to someone elses. 

 

This problem only happens when the users clicks on the link in the invoice
at the same time or 1 or 2 seconds between.

 

Because of the fact that the $paymentUrl is unique, I have always thought
that this mix up is caused by the software of MOLLIE. After more than a year
of discussions and investigations, MOLLIE is convinced that the problem is
caused by my php script, however, they can not say what's wrong.

 

We run PHP 7.4.3 on a Windows webserver in the Oracle Cloud with Apache
Tomcat/9.0.31.

 

Questions:

1.	Can you please take a look at the script below to check if you can
see any errors?
2.	Do you have an idea about the cause? And a solution?

 

Kind regards, 

 

Jan Willem Vermeer

 

PLANMYSPORT

Vliek 38, 2036CN Haarlem, Netherlands

 

 

<?php

// Start a unique session for each user.

session_start();

$paymentSession=session_id();

require_once("C:\Applications\Tomcat9\webapps\ROOT\java\Java.inc");

// Prepare a new payment with the Mollie API.

try {

  // Initialize PLANMYSPORT

  require_once("pms_payment_mollie_settings.php");

  require_once("pms_payment_mollie_connect.php");

  // Get the payment mark from the URL

  $paymentMark = $_REQUEST['payment_mark'];

  if ($paymentMark == "") {

    echo 'The payment mark is missing in the URL.';

    die;

  }

  // Get the payment data with checks

  $doChecks = true;

  require("pms_payment_mollie_info.php");

  // Initialize MOLLIE

  require("pms_payment_mollie_init.php");

  /*

   * Payment parameters:

   *   amount        Amount in EUROs with decimal dot.

   *   description   Description of the payment, named remittance info.

   *   locale        Force Dutch Mollie interface.

   *   redirectUrl   Redirect location. The customer will be redirected
there after the payment.

   *   webhookUrl    Webhook location, used to report when the payment
changes state.

   *   metadata      Custom metadata that is stored with the payment.

   */

  $payment = $mollie->payments->create([

        "amount"      => [ "currency"  => "EUR"

                         , "value"     => "{$INF_subscription_to_pay_tx}"

                         ],

        "description" => "$INF_remittance_info",

        "locale"      => "nl_NL",

        "redirectUrl" =>
https://planmysport.cloud/payments/pms_payment_mollie_ready.php?payment_mark
={$paymentMark}
<https://planmysport.cloud/payments/pms_payment_mollie_ready.php?payment_mar
k=%7b$paymentMark%7d> ,

        "webhookUrl"  =>
https://planmysport.cloud/payments/pms_payment_mollie_verify.php?payment_mar
k={$paymentMark}
<https://planmysport.cloud/payments/pms_payment_mollie_verify.php?payment_ma
rk=%7b$paymentMark%7d> ,

        "metadata"    => [ "owner"   => $INF_ior_number

                         , "year"    => $INF_fiscal_year

                         , "invoice" => $INF_ive_number

                         ],

  ]);

  $paymentId     = $payment->id;

  $paymentStatus = $payment->status;

  $paymentUrl    = $payment->getCheckoutUrl();

  $paymentSessionUrl = $paymentUrl . " " . $paymentSession; 

  // Log the values in the database

  $stmt = oci_parse($conn, "begin
pms_mollie.pms_mollie_start(:payment_mark,:payment_id,:payment_status,:payme
nt_url); end;");

  // Bind

  oci_bind_by_name($stmt, ":payment_mark"  , $paymentMark);

  oci_bind_by_name($stmt, ":payment_id"    , $paymentId);

  oci_bind_by_name($stmt, ":payment_status", $paymentStatus);

  oci_bind_by_name($stmt, ":payment_url"   , $paymentSessionUrl);

  // Execute.

  oci_execute($stmt, OCI_DEFAULT);

  // Free.

  oci_free_statement($stmt);

  // Disconnect the database

  require("pms_payment_mollie_disconnect.php");

  /*

   * Send the customer off to complete the payment.

   * This request should always be a GET, thus we enforce 303 http response
code

   */

  header("Location: " . $paymentUrl, true, 303);

  die();

} catch (\Mollie\Api\Exceptions\ApiException $e) {

    echo 'API call failed: ' . htmlspecialchars($e->getMessage());

}

?>


------=_NextPart_000_0001_01D8F032.8363DAA0--