We didn't check fully payment validation flow, we need testing credentials.

IPN security

https://github.com/PrestaShop/amzpayments/blob/dev/ipn.php#L51

It looks like there is no access control to ipn.php, everybody is able to submit a "PaymentAuthorize" message.

If ipn.php is meant to only receive notification from amazon merchant service/gateway, then the messages should be signed or authentified so we can be sure the message come from a trustable source and can't be altered.

SQL issue

https://github.com/PrestaShop/amzpayments/blob/dev/controllers/front/amzpayments.php#L404 escape $sql_arr variables with pSQL or (int) before db->insert()

https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L308 pSQL($this->name)
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L335 pSQL($this->name)
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L363 bqSQL($table) pSQL($column)
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L1636 pSQL((string) $details->getRefundStatus()->getState())
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L1657 pSQL((string) $details->getCaptureStatus()->getState())
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L1693 pSQL((string) $details->getAuthorizationStatus()->getState())
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L1723 pSQL((string) $details->getOrderReferenceStatus()->getState())
https://github.com/PrestaShop/amzpayments/blob/dev/amzpayments.php#L1941 pSQL($this->capture_status_id)
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L81 escape $sql_arr variables with pSQL or (int) before db->insert()
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L119 escape $sql_arr variables with pSQL or (int) before db->insert()
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L158 escape $sql_arr variables with pSQL or (int) before db->insert()
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L269 pSQL($type)
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L356 pSQL($oid)
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L357 pSQL($status)

https://github.com/PrestaShop/amzpayments/blob/dev/ipn.php#L59 pSQL((string) $response_xml->AuthorizationDetails->AuthorizationStatus->State)
https://github.com/PrestaShop/amzpayments/blob/dev/ipn.php#L81 pSQL((string) $response_xml->CaptureDetails->CaptureStatus->State)
https://github.com/PrestaShop/amzpayments/blob/dev/ipn.php#L101 pSQL((string) $response_xml->RefundDetails->RefundStatus->State)
https://github.com/PrestaShop/amzpayments/blob/dev/ipn.php#L114 pSQL((string) $response_xml->OrderReference->OrderReferenceStatus->State)

serialize / unserialize

Please replace all the following call of serialize/unserialize by json_encode/json_decode

If you can't, please use Tools::unSerialize() instead of unserialize()

https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L304
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L306
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L308
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L321
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L322
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L324
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L337
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L338
https://github.com/PrestaShop/amzpayments/blob/dev/classes/AmazonTransactions.php#L340

https://github.com/PrestaShop/amzpayments/blob/dev/controllers/front/amzpayments.php#L648
https://github.com/PrestaShop/amzpayments/blob/dev/controllers/front/amzpayments.php#L657

smarty template escaping

In the following templates, the variables aren't escaped, it is recommanded to always escape the variable with |escape:'htmlall'

https://github.com/PrestaShop/amzpayments/blob/dev/views/templates/admin/configuration.tpl
https://github.com/PrestaShop/amzpayments/blob/dev/views/templates/admin/order_actions.tpl
https://github.com/PrestaShop/amzpayments/blob/dev/views/templates/admin/order_history.tpl
https://github.com/PrestaShop/amzpayments/blob/dev/views/templates/admin/order_summary.tpl
https://github.com/PrestaShop/amzpayments/blob/dev/views/templates/admin/skeleton.tpl

Back office

On the configuration page, your warning message is displayed even if I have the proper version (1.6.1.1 here). But be careful, the potential number of merchants using your module will be greatly limited if you keep this restriction of PrestaShop version.

Here is a suggestion if you want a solution for the older versions, which can replace hookActionCustomerLogoutAfter:

public function hookDisplayHeader($params)
{
    [...]

    if (version_compare(_PS_VERSION_, '1.6.1.1', <) // This test can even be removed if you want
        && isset($this->context->cookie->amz_access_token)
        && ! $this->context->customer->isLogged())
    {
        unset($this->context->cookie->amz_access_token);
        unset($this->context->cookie->amazon_id);
        unset($this->context->cookie->amz_js_string);
    }

    [...]
}

Front office

On this page, it would be great to have the whole button clickable, like we can do with the other payment options.

Hi,

I have just checked the main class of the module and there are many points to fix:

• In the install() function, do NOT alter core table, because it can bring some issues during PrestaShop upgrades. Please create another table for your columns, joined by the order id or customer id.
• The HTML code must not be generated in the PHP files. In order to respect the MVC architecture, they must be moved in the tpl files. Your PHP code will be really lighter.
• Even if the module is supposed to be published for only one country, it must be written in English. Then, you can translate it in your favorite languages with the translation fonctionnality of PrestaShop.

Because fixing these points will change a whole part of your code, I wait them to be fixed before going farther in the code review.
However, I'll make a functional test later.

Best regards

Just before I can confirm an order, 2 notices appear on the page:

Module version: 2.0.57
Prestashop version: 1.6.1.11

Checkout button is deactivated, when force enabled, above enclosed warning appears. Customers cannot place orders.

We are facing the following issues:

1. We can not add a box with text and a "Login with Amazon"-Button to the authentication page, since there are no hooks available. However, to make this a convenient integration for merchants, we need this.
2. code optimization is changing the order of two JS snippets that normally should be in the header and must be in the right order. (This one might be fixed by Patrick) But anyway, how could we avoid this re-ordering?
3. We might get into trouble when jQuery in the shop is loaded before the Amazon Payments widgets.js, because then, those parts that need the jquery version which is loaded by the shop might not work correctly.
4. The module generates URLs that the merchants have to enter in their Amazon accounts to whitelist them. This URL contains the path to the module directory. While it's retrieved by means of using Prestashop-Methods, it also shows the path "modules" while in fact, the path "module" would be correct.
5. When uninstalling the old plugin, the overrides are not removed correclty, which causes errors when installing the new one afterwards.
6. Overrides are often not generated correctly, merchants have to delete the file class_index.php in the folder cache in order to redrive them.

Regards
Bernd.

Is this the same module currently included in Prestashop?

I ran into an issue with that module not recording any transactions with Google Analytics (other payment modules do so fine), so I'm curious if this one is worth a try or if the Prestashop included one is the latest version of this.

The module uses overrides but since it's a partner module it's forbidden.

In the hookDisplayHeader () method jquery 1.12 is being hardloaded again even though $this->context->controller->addJquery(); is being called right at the beginning of the function. Removing the string which loads jquery 1.12 results in "jQuery is not a function" errors and the button not appearing.

My issue with this is the unneccessary extra load time, especially since it is loaded on every page (i.e. landing pages on which speed matters and amazon pay does not need to be loaded at all) and the jquery cdn is unreliable (regarding speed...).

I realize i can exclude the module from header hook for index, category and product pages through the prestashop "positions" tool but would like a less "workaroundy" solution. Thanks for the otherwise great module!