Paypal and Paypal plus

dkfz2018 · January 21, 2019, 3:26pm

Hi,

if anybody already using paypal plugin for payment. Is paypal plus also possible with the existing paypal plugin or is there a difference ?. We are check the possibilty to pay with paypal and other payment method like credit card without an paypal account.

bpedersen2 · January 22, 2019, 1:54pm

We used the paypal plugin on one occasion. Only the seller (indico-owner ) needs to have an paypal account, users can pay via paypal wihtout an account.

Björn

ThiefMaster · January 22, 2019, 1:56pm

No idea about paypal plus, first time I heard about it. If it uses the normal paypal APIs it should work, otherwise probably not. Contributions welcome!

dkfz2018 · February 14, 2019, 10:02am

my data protection officer want to know which data field are used and send to paypal / paypalplugin for a payment.
As far as i see it there is only a sessiontoken, generatet by paypal api and a transation id which is generatet with information of the mailaccount / id of the payment account and the ammount of money.

ThiefMaster · February 14, 2019, 10:37am

You can see all the fields sent to paypal here:

github.com

indico/indico-plugins/blob/dea42805766738f97af2d1bb71b1abef3cedc5b5/payment_paypal/indico_payment_paypal/templates/event_payment_form.html#L12-L24


<form action="{{ settings.url }}" method="POST">
    <input type="hidden" name="cmd" value="_xclick">
    <input type="hidden" name="business" value="{{ event_settings.business }}">
    <input type="hidden" name="item_name" value="{{ item_name }}">
    <input type="hidden" name="amount" value="{{ amount }}">
    <input type="hidden" name="currency_code" value="{{ currency }}">
    <input type="hidden" name="charset" value="utf-8">
    <input type="hidden" name="invoice" value="{{ registration.event_id }}_{{ registration.id }}">
    <input type="hidden" name="return" value="{{ return_url }}">
    <input type="hidden" name="cancel_return" value="{{ cancel_url }}">
    <input type="hidden" name="notify_url" value="{{ notify_url }}">
    <input type="image" name="submit" src="https://www.paypalobjects.com/webstatic/en_US/btn/btn_paynow_86x21.png" alt="PayPal - The safer, easier way to pay online">
</form>

github.com

indico/indico-plugins/blob/dea42805766738f97af2d1bb71b1abef3cedc5b5/payment_paypal/indico_payment_paypal/plugin.py#L72-L78


data['item_name'] = '{}: registration for {}'.format(
    unicode_to_ascii(remove_accents(registration.full_name, reencode=False)),
    unicode_to_ascii(remove_accents(event.title, reencode=False))
)
data['return_url'] = url_for_plugin('payment_paypal.success', registration.locator.uuid, _external=True)
data['cancel_url'] = url_for_plugin('payment_paypal.cancel', registration.locator.uuid, _external=True)
data['notify_url'] = url_for_plugin('payment_paypal.notify', registration.locator.uuid, _external=True)

Note: Since the URLs contain the registration UUIDs, theoretically someone at PayPal could access all data in the registration form (maybe we should use a separate identifier for this at some point…) by using the UUID to build the URL usually used by a user to access their registration.