1

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am trying to understand is how to handle the POST variables returned from Shipworks in a secure manner.

For example, when a shipment is created in Shipworks the corresponding order id ($_REQUEST['order']) and tracking number ($_REQUEST['tracking']) are posted to Drupal at the endpoint. How do I save the tracking number in a secure manner using the entity api? Can I use the following code? 

if (is_int($_REQUEST['order'])) {
  $order_id = $_REQUEST['order'];
}
else {
  _outputError(40, "Not a valid order id.");
}

$order = commerce_order_load($order_id);

$order_wrapper = entity_metadata_wrapper('commerce_order', $order);

$tracking = $_REQUEST['tracking'];

$tracking_number = str_replace(' ', '', strtoupper($tracking));

$order_wrapper->field_tracking_numbers->set($tracking_number);
$order_wrapper->save();
Improve this question
1
  • I am using hook_menu and an access callback to protect the endpoint. I added a new user role and a Shipworks user in Drupal. The Shipworks user has the permission to access to the endpoint. Thank you for your help.
    – PaulJ
    Commented Dec 31, 2014 at 18:19

1 Answer 1

Reset to default
0

It really depends on how ShipWorks works. If it lets you specify a URL when it downloads the order data, you could use a secret key appended to the URL that you can use to authenticate a request as Ayeshk mentions. If it allows the merchant to specify a URL in a configuration form, at least you can set the secret key once and have the merchant copy it, kind of like how Drupal appends a secret key to the cron URL.

I also have a project upcoming that requires ShipWorks. Are you sharing the code publicly anywhere?

Improve this answer
2
  • In Shipworks, you specify an endpoint, username and password. I created a user in Drupal with the same username and password and gave it permission to access the endpoint via a hook_menu access callback. My main concern is if somehow the endpoint, username and password were compromised I could be susceptible to an sql injection. Yes, I can share what I have so far. I will post it to Github and then post the url here. Thank you for your help.
    – PaulJ
    Commented Dec 31, 2014 at 18:31
  • The code is available on Github at github.com/pnigro/commerce_shipworks. It does require some custom fields attached to the order entity including field_payment_status, field_order_admin_notes, field_tracking_numbers and field_order_phone_number. The module does work. It just needs a little love. Any comments or suggestions would be greatly appreciated. Thank you.
    – PaulJ
    Commented Jan 2, 2015 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.