Cartthrob payment gateway (Worldpay) callback gives "the action you have requested invalid post back"

Question

Using Cartthrob 2.4 and EE 2.7, paying via Worldpay, returns this message:

the action you have requested is invalid

My guess is its the new security introduced for POST requests, that require a new XID set, so does anyone know how to deal with this for external websites like Worldpay submitting call backs?

Thanks

Answer 1

We have fixed this with a couple of changes, seems Cartthrob has a couple of issues...

1) Based on this post XID POST from third party we added the we added 'csrf_exempt' => 1 into the database for the payment_return_action in the Cartthrob exp_actions table. We do not know if this helped, but seems like we should do it. Carttrhob does not add this in when installed or updated.

2) Next issue the callback URL to enter into Worldpay was not working, http:// or , so we managed to find out this URl should be http://ourdomain.co.uk/themes/third_party/cartthrob/lib/extload.php/worldpay_redirect, so we entered that into Worldpay and that works, almost....

3) The callback page showed an error along the lines of "Cartthrob detected an incorrect system folder path, update the system folder path in Extload: extload.php". Or something along those lines. It seems Carttrhob assumes our system folder will be called system. For security we renamed it. Why on earth Carttrhob does not use the setting in EE index.php, and there is no instruction about this, so we updated our system folder path in third_party/cartthrob/lib/extload.php and now it all works OK.

So I guess 3 issues needed to be fixed to get Carttrhob Worldpay to accept payments.

Answer 2

We were able to get this working by following point 1 above using CT2.4 with EE2.7.2 with the PayPoint.net gateway (https://github.com/dmlogic/ct_paypoint)

Answer 3

I'm having similar issues with Sagepay and getting nowhere fast (frustrating lack of support!). However, I thought I should add that you can edit extload.php with your custom system name (and location) - so you don't have to stick with 'system'

Answer 4

Due to the new EE security preventing forms being submitted without an XID (therefore third party gateways can't submit POST notifications), we now use this in our config.php file for Payment Gateways

/*
|--------------------------------------------------------------------------
| Disable CSRF for Sagepay
|--------------------------------------------------------------------------
|
| This will disable CSRF for Sagepay Request, so payment will work
|
*/
if(stripos($_SERVER["REQUEST_URI"],'/themes/third_party/cartthrob/lib/extload.php/sage_s') !== FALSE)
{
    $config['disable_csrf_protection'] = "y";
}