MC-15427: Token Abuse in PayPal Payflow module

Block/LayoutProcessor/Checkout/Onepage.php

@@ -52,6 +52,10 @@ public function process($jsLayout)
             ['shippingAddress']['children']['customer-email']['children']
             ['msp_recaptcha']['settings'] = $this->layoutSettings->getCaptchaSettings();
 
+        $jsLayout['components']['checkout']['children']['steps']['children']['billing-step']['children']
+            ['payment']['children']['payments-list']['children']['additional-payment-fields']['children']
+            ['msp_recaptcha']['settings'] = $this->layoutSettings->getCaptchaSettings();
+
         $jsLayout['components']['checkout']['children']['authentication']['children']
             ['msp_recaptcha']['settings'] = $this->layoutSettings->getCaptchaSettings();
 

Model/Config.php

@@ -47,6 +47,7 @@ class Config
     const XML_PATH_ENABLED_FRONTEND_FORGOT = 'msp_securitysuite_recaptcha/frontend/enabled_forgot';
     const XML_PATH_ENABLED_FRONTEND_CONTACT = 'msp_securitysuite_recaptcha/frontend/enabled_contact';
     const XML_PATH_ENABLED_FRONTEND_CREATE = 'msp_securitysuite_recaptcha/frontend/enabled_create';
+    const XML_PATH_ENABLED_FRONTEND_PAYPAL = 'msp_securitysuite_recaptcha/frontend/enabled_paypal';
 
     /**
      * @var ScopeConfigInterface
@@ -167,6 +168,19 @@ public function isEnabledFrontendCreate()
         return (bool) $this->scopeConfig->getValue(static::XML_PATH_ENABLED_FRONTEND_CREATE);
     }
 
+    /**
+     * Return true if enabled on frontend PayPal PayflowPro payment form
+     * @return bool
+     */
+    public function isEnabledFrontendPaypal()
+    {
+        if (!$this->isEnabledFrontend()) {
+            return false;
+        }
+
+        return (bool) $this->scopeConfig->getValue(static::XML_PATH_ENABLED_FRONTEND_PAYPAL);
+    }
+
     /**
      * Get data size
      * @return string

Model/LayoutSettings.php

@@ -55,6 +55,7 @@ public function getCaptchaSettings()
                 'create' => $this->config->isEnabledFrontendCreate(),
                 'forgot' => $this->config->isEnabledFrontendForgot(),
                 'contact' => $this->config->isEnabledFrontendContact(),
+                'paypal' => $this->config->isEnabledFrontendPaypal(),
             ]
         ];
     }

Model/Provider/Failure/PaymentTransparentResponseFailure.php

@@ -0,0 +1,80 @@
+<?php
+/**
+ * MageSpecialist
+ *
+ * NOTICE OF LICENSE
+ *
+ * This source file is subject to the Open Software License (OSL 3.0)
+ * that is bundled with this package in the file LICENSE.txt.
+ * It is also available through the world-wide-web at this URL:
+ * http://opensource.org/licenses/osl-3.0.php
+ * If you did not receive a copy of the license and are unable to
+ * obtain it through the world-wide-web, please send an email
+ * to [email protected] so we can send you a copy immediately.
+ *
+ * @category   MSP
+ * @package    MSP_ReCaptcha
+ * @copyright  Copyright (c) 2017 Skeeller srl (http://www.magespecialist.it)
+ * @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+namespace MSP\ReCaptcha\Model\Provider\Failure;
+
+use Magento\Framework\App\ActionFlag;
+use Magento\Framework\App\ResponseInterface;
+use Magento\Framework\App\Action\Action;
+use Magento\Framework\Json\EncoderInterface;
+use MSP\ReCaptcha\Model\Config;
+use MSP\ReCaptcha\Model\Provider\FailureProviderInterface;
+
+/**
+ * Handle reCaptcha failure for payment transparent redirect implementation.
+ */
+class PaymentTransparentResponseFailure implements FailureProviderInterface
+{
+    /**
+     * @var ActionFlag
+     */
+    private $actionFlag;
+
+    /**
+     * @var EncoderInterface
+     */
+    private $encoder;
+
+    /**
+     * @var Config
+     */
+    private $config;
+
+    /**
+     * @param ActionFlag $actionFlag
+     * @param EncoderInterface $encoder
+     * @param Config $config
+     */
+    public function __construct(
+        ActionFlag $actionFlag,
+        EncoderInterface $encoder,
+        Config $config
+    ) {
+        $this->actionFlag = $actionFlag;
+        $this->encoder = $encoder;
+        $this->config = $config;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute(ResponseInterface $response = null)
+    {
+        $this->actionFlag->set('', Action::FLAG_NO_DISPATCH, true);
+
+        $jsonPayload = $this->encoder->encode([
+            'success' => false,
+            'error' => true,
+            'error_messages' => $this->config->getErrorDescription(),
+        ]);
+
+        $response->representJson($jsonPayload);
+    }
+}

etc/adminhtml/system.xml

@@ -160,6 +160,14 @@
                         <field id="enabled">1</field>
                     </depends>
                 </field>
+                <field id="enabled_paypal" translate="label" type="select" sortOrder="230" showInDefault="1"
+                       showInWebsite="1" showInStore="0" canRestore="1">
+                    <label>Use in PayPal PayflowPro payment form</label>
+                    <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
+                    <depends>
+                        <field id="enabled">1</field>
+                    </depends>
+                </field>
             </group>
         </section>
     </system>

etc/config.xml

@@ -39,6 +39,7 @@
                 <enabled_forgot>1</enabled_forgot>
                 <enabled_contact>1</enabled_contact>
                 <enabled_create>1</enabled_create>
+                <enabled_paypal>0</enabled_paypal>
             </frontend>
         </msp_securitysuite_recaptcha>
     </default>

etc/frontend/di.xml

@@ -175,4 +175,23 @@
         <plugin sortOrder="1" name="mSPReCaptchaAuthenticationPopup"
                 type="MSP\ReCaptcha\Plugin\Block\Account\AuthenticationPopupPlugin"/>
     </type>
+
+    <!-- PayPal PayflowPro Form -->
+    <virtualType name="MSP\ReCaptcha\Model\Provider\IsCheckRequired\Frontend\PayPal"
+                 type="MSP\ReCaptcha\Model\IsCheckRequired">
+        <arguments>
+            <argument name="enableConfigFlag"
+                      xsi:type="string">msp_securitysuite_recaptcha/frontend/enabled_paypal</argument>
+            <argument name="area" xsi:type="string">frontend</argument>
+        </arguments>
+    </virtualType>
+    <virtualType name="MSP\ReCaptcha\Observer\Frontend\PayPalObserver"
+                 type="MSP\ReCaptcha\Observer\ReCaptchaObserver">
+        <arguments>
+            <argument name="isCheckRequired"
+                      xsi:type="object">MSP\ReCaptcha\Model\Provider\IsCheckRequired\Frontend\PayPal</argument>
+            <argument name="failureProvider"
+                      xsi:type="object">MSP\ReCaptcha\Model\Provider\Failure\PaymentTransparentResponseFailure</argument>
+        </arguments>
+    </virtualType>
 </config>

etc/frontend/events.xml

@@ -37,4 +37,7 @@
     <event name="controller_action_predispatch_contact_index_post">
         <observer name="msp_captcha" instance="MSP\ReCaptcha\Observer\Frontend\ContactFormObserver" />
     </event>
+    <event name="controller_action_predispatch_paypal_transparent_requestsecuretoken">
+        <observer name="msp_captcha" instance="MSP\ReCaptcha\Observer\Frontend\PayPalObserver" />
+    </event>
 </config>

view/frontend/layout/checkout_index_index.xml

@@ -21,7 +21,6 @@
 -->
 <page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
-
     <body>
         <referenceBlock name="checkout.root">
             <arguments>
@@ -31,6 +30,29 @@
                             <item name="children" xsi:type="array">
                                 <item name="steps" xsi:type="array">
                                     <item name="children" xsi:type="array">
+                                        <item name="billing-step" xsi:type="array">
+                                            <item name="children" xsi:type="array">
+                                                <item name="payment" xsi:type="array">
+                                                    <item name="children" xsi:type="array">
+                                                        <item name="payments-list" xsi:type="array">
+                                                            <item name="children" xsi:type="array">
+                                                                <item name="additional-payment-fields" xsi:type="array">
+                                                                    <item name="children" xsi:type="array">
+                                                                        <item name="msp_recaptcha" xsi:type="array">
+                                                                            <item name="component" xsi:type="string">MSP_ReCaptcha/js/asyncReCaptcha</item>
+                                                                            <item name="displayArea" xsi:type="string">additional-payment-fields</item>
+                                                                            <item name="configSource" xsi:type="string">checkoutConfig</item>
+                                                                            <item name="reCaptchaId" xsi:type="string">msp-recaptcha-checkout-paypal-form</item>
+                                                                            <item name="zone" xsi:type="string">paypal</item>
+                                                                        </item>
+                                                                    </item>
+                                                                </item>
+                                                            </item>
+                                                        </item>
+                                                    </item>
+                                                </item>
+                                            </item>
+                                        </item>
                                         <item name="shipping-step" xsi:type="array">
                                             <item name="children" xsi:type="array">
                                                 <item name="shippingAddress" xsi:type="array">
@@ -52,7 +74,6 @@
                                         </item>
                                     </item>
                                 </item>
-
                                 <item name="authentication" xsi:type="array">
                                     <item name="children" xsi:type="array">
                                         <item name="msp_recaptcha" xsi:type="array">

view/frontend/requirejs-config.js

@@ -23,6 +23,9 @@ var config = {
         mixins: {
             'Magento_Ui/js/view/messages': {
                 'MSP_ReCaptcha/js/ui-messages-mixin': true
+            },
+            'Magento_Payment/js/transparent': {
+                'MSP_ReCaptcha/js/transparent-mixin': true
             }
         }
     }

view/frontend/web/js/asyncReCaptcha.js

@@ -0,0 +1,107 @@
+/**
+ * MageSpecialist
+ *
+ * NOTICE OF LICENSE
+ *
+ * This source file is subject to the Open Software License (OSL 3.0)
+ * that is bundled with this package in the file LICENSE.txt.
+ * It is also available through the world-wide-web at this URL:
+ * http://opensource.org/licenses/osl-3.0.php
+ * If you did not receive a copy of the license and are unable to
+ * obtain it through the world-wide-web, please send an email
+ * to [email protected] so we can send you a copy immediately.
+ *
+ * @copyright  Copyright (c) 2017 Skeeller srl (http://www.magespecialist.it)
+ * @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+'use strict';
+
+define(
+    [
+        'MSP_ReCaptcha/js/reCaptcha',
+        'jquery',
+        'ko',
+        'MSP_ReCaptcha/js/registry'
+    ],
+    function (Component, $, ko, registry, undefined) {
+
+        return Component.extend({
+
+            /**
+             * Recaptcha callback
+             * @param {String} token
+             */
+            reCaptchaCallback: function (token) {
+                this.tokenField.value = token;
+                this.$parentForm.trigger('captcha:endExecute');
+            },
+
+            /**
+             * Initialize reCaptcha after first rendering
+             */
+            initCaptcha: function () {
+                var me = this,
+                    $parentForm,
+                    $wrapper,
+                    $reCaptcha,
+                    widgetId;
+
+                if (this.captchaInitialized) {
+                    return;
+                }
+
+                this.captchaInitialized = true;
+
+                /*
+                 * Workaround for data-bind issue:
+                 * We cannot use data-bind to link a dynamic id to our component
+                 * See: https://stackoverflow.com/questions/46657573/recaptcha-the-bind-parameter-must-be-an-element-or-id
+                 *
+                 * We create a wrapper element with a wrapping id and we inject the real ID with jQuery.
+                 * In this way we have no data-bind attribute at all in our reCaptcha div
+                 */
+                $wrapper = $('#' + this.getReCaptchaId() + '-wrapper');
+                $reCaptcha = $wrapper.find('.g-recaptcha');
+                $reCaptcha.attr('id', this.getReCaptchaId());
+
+                $parentForm = $wrapper.parents('form');
+
+                // eslint-disable-next-line no-undef
+                widgetId = grecaptcha.render(this.getReCaptchaId(), {
+                    'sitekey': this.settings.siteKey,
+                    'theme': this.settings.theme,
+                    'size': this.settings.size,
+                    'badge': this.badge ? this.badge : this.settings.badge,
+                    'callback': function (token) { // jscs:ignore jsDoc
+                        me.reCaptchaCallback(token);
+                        me.validateReCaptcha(true);
+                    },
+                    'expired-callback': function () {
+                        me.validateReCaptcha(false);
+                    }
+                });
+
+                $parentForm.on('captcha:startExecute', function (event) {
+                    if (!me.tokenField.value && me.settings.size === 'invisible') {
+                        // eslint-disable-next-line no-undef
+                        grecaptcha.execute(widgetId);
+                        event.preventDefault(event);
+                        event.stopImmediatePropagation();
+                    } else {
+                        me.$parentForm.trigger('captcha:endExecute');
+                    }
+                });
+
+                // Create a virtual token field
+                this.tokenField = $('<input type="text" name="token" style="display: none" />')[0];
+                this.$parentForm = $parentForm;
+                $parentForm.append(this.tokenField);
+
+                registry.ids.push(this.getReCaptchaId());
+                registry.captchaList.push(widgetId);
+                registry.tokenFields.push(this.tokenField);
+            }
+        });
+    }
+);

view/frontend/web/js/transparent-mixin.js

@@ -0,0 +1,39 @@
+/**
+ * MageSpecialist
+ *
+ * NOTICE OF LICENSE
+ *
+ * This source file is subject to the Open Software License (OSL 3.0)
+ * that is bundled with this package in the file LICENSE.txt.
+ * It is also available through the world-wide-web at this URL:
+ * http://opensource.org/licenses/osl-3.0.php
+ * If you did not receive a copy of the license and are unable to
+ * obtain it through the world-wide-web, please send an email
+ * to [email protected] so we can send you a copy immediately.
+ *
+ * @copyright  Copyright (c) 2017 Skeeller srl (http://www.magespecialist.it)
+ * @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+'use strict';
+
+define(['jquery', 'jquery/ui'], function ($) {
+    return function (originalTransparent) {
+        return $.widget('mage.transparent', originalTransparent, {
+            _orderSave: function () {
+                var original = this._superApply.bind(this),
+                    args = arguments;
+
+                $(this.options.paymentFormSelector).on('captcha:endExecute', function () {
+                    original(args);
+                });
+
+                $(this.options.paymentFormSelector).trigger('captcha:startExecute');
+
+                return  {
+                    fail: function () {}
+                }
+            }
+        })
+    };
+});