CartThrob Sage Pay error

Question

Working with CartThrob and SagePay on a site and get the following error at checkout (after submitting card details):

HTTP Status Code: 500 HTTP Status Message: The request was unsuccessful due to an unexpected condition encountered by the server. Error Code : 5006 Error Description : Unable to redirect to Vendor's web site. The Vendor failed to provide a RedirectionURL.

Have set up a Valid IP with SagePay. Note this is for dealing with token payments (in recurring subscriptions) and is checking against a test gateway.

Answer 1

Due to the new EE security preventing forms being submitted without an XID, third party gateways can't submit POST notifications. The csrf protection needs to be disabled. To prevent disabling the security feature globally, we use this in our config.php file for Payment Gateways:

/*
|--------------------------------------------------------------------------
| Disable CSRF for Sagepay
|--------------------------------------------------------------------------
|
| This will disable CSRF for Sagepay Request, so payment will work
|
*/
if(stripos($_SERVER["REQUEST_URI"],'/themes/third_party/cartthrob/lib/extload.php/sage_s') !== FALSE)
{
    $config['disable_csrf_protection'] = "y";
}

More information here:

Cartthrob payment gateway (Worldpay) callback gives "the action you have requested invalid post back"

Answer 2

When you post through to Sage Pay from your site Sage Pay will process the transaction for you and feedback the results of the AVS/CV2 checks that have been performed by the card issuer. At this point we will send you a notification post containing these results, your site must then send through an acknowledgment that this POST has been received and letting Sage Pay know how you wish to proceed. You will need to include three fields within your acknowledgment, these are listed below with their descriptions.

• Status - Alphabetic, Max 20 characters. This field can have multiple responses.

  • OK – Send this if you successfully received the notification Post from Sage Pay. Send this unless an error occurs during notification.
  • INVALID – send INVALID if the details you received in the post from Sage Pay were consistent with expectations for this Transaction but you do not wish to accept the transaction. The RedirectURL must still be provided, and Sage Pay will still redirect the Customer back to your site, but the transaction will NOT be settled with the bank. Only send this result if you want to cancel the transaction.
  • ERROR – An error has occurred during your Notification processing. The Sage Pay system will check for a RedirectURL, and if one is provided the Customer will be redirected to your site, but the transaction will NOT be settled with the bank. Only send this result if you want to cancel the transaction and report an ERROR to Sage Pay.

Please Note: OK statuses will allow the transaction to settle and money to move into the Vendor account. INVALID or ERROR responses will prevent the transaction from settling, so the customer will not be charged. You should send OK in all circumstances where no errors occur in validating the Notification POST, so even if Sage Pay send you a status of ABORT or NOTAUTHED, you should reply with an OK and a RedirectURL that points to a page informing the customer that the transaction did not complete.

• RedirectURL - Alphanumeric, Max 255 characters. This is a fully qualified URL (including http:// or https:// header) to which you’d like the customer redirected on completion of the transaction.

Please Note: If you wish to pass parameters back to your own site (such as the session id or transaction code), these should be included in RedirectURL.

• StatusDetail - Alphanumeric, Max 255 characters. This should be human-readable text providing extra detail for the Status message. If Status is not OK, state what is wrong with the Transaction and why you are rejecting it.

If you are receiving an error message and are sending through the correct fields and responses please check you clear your response buffer to remove any header code, comments or HTML. The Sage Pay Server is expecting “Status=” to be the first characters in the response. If it does not see these, it treats the response as though it is an error and fails the transaction.

Please also note that all POSTs must be communicated through ports 80 and 443.

If you are receiving a 5006 error message this would suggest that we are having trouble understanding the information that is being passed to us at this point.