diff --git a/lib/razorpay/utility.rb b/lib/razorpay/utility.rb index 16669d4..1484d0a 100644 --- a/lib/razorpay/utility.rb +++ b/lib/razorpay/utility.rb @@ -4,11 +4,12 @@ module Razorpay # Helper functions are defined here class Utility def self.verify_payment_signature(attributes) - signature = attributes[:razorpay_signature] - order_id = attributes[:razorpay_order_id] || attributes[:razorpay_subscription_id] - payment_id = attributes[:razorpay_payment_id] + signature = attributes.delete(:razorpay_signature) - data = [order_id, payment_id].join '|' + # Data requires the values to be in sorted order of their keys. + # attributes.sort returns a nested array, and the last + # element of each is the value. These are joined. + data = attributes.sort.map(&:last).join('|') secret = Razorpay.auth[:password] diff --git a/test/razorpay/test_utility.rb b/test/razorpay/test_utility.rb index 2edd93d..913111c 100644 --- a/test/razorpay/test_utility.rb +++ b/test/razorpay/test_utility.rb @@ -9,9 +9,9 @@ def setup def test_payment_signature_verification payment_response = { - razorpay_order_id: 'fake_order_id', + razorpay_order_id: 'fake_other_id', razorpay_payment_id: 'fake_payment_id', - razorpay_signature: 'b2335e3b0801106b84a7faff035df56ecffde06918c9ddd1f0fafbb37a51cc89' + razorpay_signature: '965ee2de4c5c4e6f006fb0a5a1736d992e5d4d52f9fe10b98c9b97ee169ebe18' } Razorpay::Utility.verify_payment_signature(payment_response) @@ -23,10 +23,12 @@ def test_payment_signature_verification def test_subscription_signature_verification payment_response = { - razorpay_subscription_id: 'fake_order_id', razorpay_payment_id: 'fake_payment_id', - razorpay_signature: 'b2335e3b0801106b84a7faff035df56ecffde06918c9ddd1f0fafbb37a51cc89' + razorpay_subscription_id: 'fake_other_id', + razorpay_signature: '3dabcab8ca113e7994cf78c80f8d50974ddfb2d380029743f30a6d67934cd845' } + # A different signature is expected here compared to the previous test, + # since the sorted order of the keys is different in this case Razorpay::Utility.verify_payment_signature(payment_response) payment_response[:razorpay_signature] = '_dummy_signature' * 4