Payment API Session Expiration Enhancement

logic/settlement/controller.php

@@ -41,6 +41,9 @@ class ControlSettlement extends LogicSettlement {
 			    case TYPE_FAIL:
 			        require_once($this -> getUserHTML('TEMPLATE_SETTLEMENT_FAIL_PATH'));
 			        break;
+			    case TYPE_REQUEST_SESSION_EXPIRED:
+			        require_once($this -> getUserHTML('TEMPLATE_SETTLEMENT_REQUEST_EXPIRED_PATH'));
+			        break;
 			}
 
 		} catch (Exception $e) {

logic/settlement/model.php

@@ -343,11 +343,11 @@ class SettlementModelClass extends ModelClassEx {
 	                $this -> settleForm    = $this -> getSettlementForm($midsign -> uniqueKey);
 	                
 	                $redirection = function($deleteForm = true) use ($midsign, $settleData) {
-	                    if($deleteForm)
+	                    if($deleteForm){
 	                        $this -> accessModify("DELETE_SETTLEMENT_FORM", [$midsign -> uniqueKey], false);
-	                        
-	                    header("Location: /{$settleData -> language}");
-	                    exit();
+	                        $this -> setType(TYPE_REQUEST_SESSION_EXPIRED);
+	                    }else
+	                        header("Location: /{$settleData -> language}");
 	                };
 	                
 	                if($this -> settleForm){
@@ -455,21 +455,50 @@ class SettlementModelClass extends ModelClassEx {
 	        $this -> setType(TYPE_FAIL);
 	}
 	
-	private function validateProcessing(){
-	    if($this -> uniqueSubmission == $this -> formName.md5($this -> paymentAPIConf -> middleware_sig_passphrase)){
-	        $this -> setData();
-	        $this -> arrangeFreeParams();
+	private function validateProcessing(){	
+	    try{
+	        $midPsignKey = $this -> paymentAPIConf -> middleware_sig_passphrase;
+	        $jwtTokenKey = $this -> midconf -> token_secretkey.strtotime(date("Ymd"));
 	        
-	        if($this -> balance < ($this -> debitAmount + $this -> getFeeEx())) {
-	            $this -> invalidFormParams[] = $this -> getMessage(ERROR, 'E_INSUFFICIENT_FUNDS',
-	                array($this -> debitCurrency,
-	                    $this -> formatCurrency(($this -> debitAmount + $this -> getFeeEx()), $this -> debitCurrency)));
-	        }
-	    }else
-	        $this -> invalidFormParams[] = "Invalid Submission Identifier!";
-	    
-	    if($this -> isLoopData($this -> invalidFormParams))
-	        $this -> setType(TYPE_FAIL);
+	        // throwable
+	        $decoded = JWT::decode(
+	            $this -> paymentToken,
+	            $jwtTokenKey,
+	            [$this -> midconf -> algorithm]);
+	        
+	        // throwable
+	        $midsign      = Crypto::decryptWithPassword($decoded -> midsign, $midPsignKey);
+	        
+	        if($this -> checkJSONString($midsign)){
+	            $midsign = json_decode($midsign);
+	            
+	            $expire    = strtotime($midsign -> expiration);
+	            $now       = strtotime(date("YmdHis"));   
+	             
+	            if($now > $expire)
+	                throw new Exception("Session Expired");
+	        }else
+	            throw new Exception("Not a JSON String");
+	        
+	        if($this -> uniqueSubmission == $this -> formName.md5($this -> paymentAPIConf -> middleware_sig_passphrase)){
+	            $this -> setData();
+	            $this -> arrangeFreeParams();
+	            
+	            if($this -> balance < ($this -> debitAmount + $this -> getFeeEx())) {
+	                $this -> invalidFormParams[] = $this -> getMessage(ERROR, 'E_INSUFFICIENT_FUNDS',
+	                       array($this -> debitCurrency,
+	                       $this -> formatCurrency(($this -> debitAmount + $this -> getFeeEx()), $this -> debitCurrency)));
+	            }
+	        }else
+	            $this -> invalidFormParams[] = "Invalid Submission Identifier!";
+	            
+	        if($this -> isLoopData($this -> invalidFormParams))
+	           $this -> setType(TYPE_FAIL);
+	        
+	    }catch(Exception $e){
+	        $this -> accessModify("DELETE_SETTLEMENT_FORM", [$this -> formName], false);
+	        $this -> setType(TYPE_REQUEST_SESSION_EXPIRED);
+	    }
 	}
 	
 	private function arrangeFormLink(){