Payment API Session Expiration Enhancement

logic/settlement/controller.php

@@ -41,6 +41,9 @@ class ControlSettlement extends LogicSettlement {
 			    case TYPE_FAIL:
 			        require_once($this -> getUserHTML('TEMPLATE_SETTLEMENT_FAIL_PATH'));
 			        break;
+			    case TYPE_REQUEST_SESSION_EXPIRED:
+			        require_once($this -> getUserHTML('TEMPLATE_SETTLEMENT_REQUEST_EXPIRED_PATH'));
+			        break;
 			}
 
 		} catch (Exception $e) {

logic/settlement/model.php

@@ -343,11 +343,11 @@ class SettlementModelClass extends ModelClassEx {
 	                $this -> settleForm    = $this -> getSettlementForm($midsign -> uniqueKey);
 	                
 	                $redirection = function($deleteForm = true) use ($midsign, $settleData) {
-	                    if($deleteForm)
+	                    if($deleteForm){
 	                        $this -> accessModify("DELETE_SETTLEMENT_FORM", [$midsign -> uniqueKey], false);
-	                        
+	                        $this -> setType(TYPE_REQUEST_SESSION_EXPIRED);
+	                    }else
 	                        header("Location: /{$settleData -> language}");
-	                    exit();
 	                };
 	                
 	                if($this -> settleForm){
@@ -456,6 +456,30 @@ class SettlementModelClass extends ModelClassEx {
 	}
 	
 	private function validateProcessing(){	
+	    try{
+	        $midPsignKey = $this -> paymentAPIConf -> middleware_sig_passphrase;
+	        $jwtTokenKey = $this -> midconf -> token_secretkey.strtotime(date("Ymd"));
+	        
+	        // throwable
+	        $decoded = JWT::decode(
+	            $this -> paymentToken,
+	            $jwtTokenKey,
+	            [$this -> midconf -> algorithm]);
+	        
+	        // throwable
+	        $midsign      = Crypto::decryptWithPassword($decoded -> midsign, $midPsignKey);
+	        
+	        if($this -> checkJSONString($midsign)){
+	            $midsign = json_decode($midsign);
+	            
+	            $expire    = strtotime($midsign -> expiration);
+	            $now       = strtotime(date("YmdHis"));   
+	             
+	            if($now > $expire)
+	                throw new Exception("Session Expired");
+	        }else
+	            throw new Exception("Not a JSON String");
+	        
 	        if($this -> uniqueSubmission == $this -> formName.md5($this -> paymentAPIConf -> middleware_sig_passphrase)){
 	            $this -> setData();
 	            $this -> arrangeFreeParams();
@@ -470,6 +494,11 @@ class SettlementModelClass extends ModelClassEx {
 	            
 	        if($this -> isLoopData($this -> invalidFormParams))
 	           $this -> setType(TYPE_FAIL);
+	        
+	    }catch(Exception $e){
+	        $this -> accessModify("DELETE_SETTLEMENT_FORM", [$this -> formName], false);
+	        $this -> setType(TYPE_REQUEST_SESSION_EXPIRED);
+	    }
 	}
 	
 	private function arrangeFormLink(){