Fix ShipStation plugin for Magento 2.3

fix-shipstation-plugin-for-magento-2.3.patch

From 15db78fd75a7fc473d72157cb952f36739b125c7 Mon Sep 17 00:00:00 2001
From: Hailong Zhao <[email protected]>
Date: Sat, 13 Apr 2019 23:13:58 -0400
Subject: [PATCH] Fix ShipStation plugin.

---
 .../Auctane/Api/Controller/Auctane/Index.php  | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/app/code/Auctane/Api/Controller/Auctane/Index.php b/app/code/Auctane/Api/Controller/Auctane/Index.php
index 53f9664f..a3319f17 100644
--- a/app/code/Auctane/Api/Controller/Auctane/Index.php
+++ b/app/code/Auctane/Api/Controller/Auctane/Index.php
@@ -2,9 +2,29 @@
 namespace Auctane\Api\Controller\Auctane;
 
 use Exception;
+use Magento\Framework\App\CsrfAwareActionInterface;
+use Magento\Framework\App\Request\InvalidRequestException;
+use Magento\Framework\App\RequestInterface;
 
-class Index extends \Magento\Framework\App\Action\Action
+class Index extends \Magento\Framework\App\Action\Action implements CsrfAwareActionInterface
 {
+    /**
+     * @inheritDoc
+     */
+    public function createCsrfValidationException(
+        RequestInterface $request
+    ): ?InvalidRequestException {
+        return null;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function validateForCsrf(RequestInterface $request): ?bool
+    {
+        return true;
+    }
+
     /**
      * Default function
      *
-- 
2.20.1 (Apple Git-117)

Index.php

<?php
namespace Auctane\Api\Controller\Auctane;

use Exception;
use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;

class Index extends \Magento\Framework\App\Action\Action implements CsrfAwareActionInterface
{
    /**
     * @inheritDoc
     */
    public function createCsrfValidationException(
        RequestInterface $request
    ): ?InvalidRequestException {
        return null;
    }

    /**
     * @inheritDoc
     */
    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }

    /**
     * Default function
     *
     * @return void
     */
    public function execute()
    {
        $authUser = $this->getRequest()->getParam('SS-UserName');
        $authPassword = $this->getRequest()->getParam('SS-Password');

        // \Magento\Store\Model\StoreManagerInterface $storeManager
        $storeManager = $this->_objectManager->get(
            'Magento\Store\Model\StoreManagerInterface'
        );
        $storeId = $storeManager->getStore()->getId();

        $storageInterface = $this->_objectManager->get(
            '\Magento\Backend\Model\Auth\Credential\StorageInterface'
        );
        $userAuthentication = $storageInterface->authenticate(
            $authUser,
            $authPassword
        );

        $dataHelper = $this->_objectManager->get('Auctane\Api\Helper\Data');
        if (!$userAuthentication) {
            header(sprintf('WWW-Authenticate: Basic realm=ShipStation'));
            $result = $dataHelper->fault(401, 'Authentication failed');
            header('Content-Type: text/xml; charset=UTF-8');
            $this->getResponse()->setBody($result);
            return false;
        }

        //Get the requested action
        $action = $this->getRequest()->getParam('action');
        try {
            switch ($action) {
                case 'export':
                    $export = $this->_objectManager->get(
                        'Auctane\Api\Model\Action\Export'
                    );
                    $result = $export->process($this->getRequest(), $storeId);
                    break;

                case 'shipnotify':
                    $shipNotify = $this->_objectManager->get(
                        'Auctane\Api\Model\Action\ShipNotify'
                    );
                    $result = $shipNotify->process($this->getRequest());
                    // if there hasn't been an error then "200 OK" is given
                    break;
            }
        } catch (Exception $fault) {
            $result = $dataHelper->fault($fault->getCode(), $fault->getMessage());
        }

        $this->getResponse()->setBody($result);
    }
}

Patch file for ShipStation 2.1.24

From d922c449c13246f370c66865ad2714f7f2fe4a8e Mon Sep 17 00:00:00 2001
From: Hailong Zhao <[email protected]>
Date: Wed, 8 Apr 2020 22:21:41 -0400
Subject: [PATCH] Patch for ShipStation 2.1.24

---
 Index.php | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/Index.php b/Index.php
index da9748a..b64be58 100644
--- a/Index.php
+++ b/Index.php
@@ -10,10 +10,13 @@ use Magento\Backend\Model\Auth\Credential\StorageInterface;
 use Magento\Backend\Model\View\Result\RedirectFactory;
 use Magento\Framework\App\Action\Action;
 use Magento\Framework\App\Action\Context;
+use Magento\Framework\App\CsrfAwareActionInterface;
+use Magento\Framework\App\Request\InvalidRequestException;
+use Magento\Framework\App\RequestInterface;
 use Magento\Framework\App\Config\ScopeConfigInterface;
 use Magento\Store\Model\StoreManagerInterface;
 
-class Index extends Action
+class Index extends Action implements CsrfAwareActionInterface
 {
     /**
      * @var StoreManagerInterface
@@ -65,6 +68,23 @@ class Index extends Action
         $this->redirectFactory = $redirectFactory;
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function createCsrfValidationException(
+        RequestInterface $request
+    ): ?InvalidRequestException {
+        return null;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function validateForCsrf(RequestInterface $request): ?bool
+    {
+        return true;
+    }
+
     /**
      * Default function
      *
-- 
2.24.1 (Apple Git-126)

Patched Index.php of ShipStation 2.1.24

<?php

namespace Auctane\Api\Controller\Auctane;

use Auctane\Api\Helper\Data;
use Auctane\Api\Model\Action\Export;
use Auctane\Api\Model\Action\ShipNotify;
use Exception;
use Magento\Backend\Model\Auth\Credential\StorageInterface;
use Magento\Backend\Model\View\Result\RedirectFactory;
use Magento\Framework\App\Action\Action;
use Magento\Framework\App\Action\Context;
use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;
use Magento\Framework\App\Config\ScopeConfigInterface;
use Magento\Store\Model\StoreManagerInterface;

class Index extends Action implements CsrfAwareActionInterface
{
    /**
     * @var StoreManagerInterface
     */
    private $storeManager;
    /**
     * @var StorageInterface
     */
    private $storage;
    /**
     * @var ScopeConfigInterface
     */
    private $scopeConfig;
    /**
     * @var Data
     */
    private $dataHelper;
    /**
     * @var Export
     */
    private $export;
    /**
     * @var ShipNotify
     */
    private $shipNotify;
    /**
     * @var RedirectFactory
     */
    private $redirectFactory;

    public function __construct(
        Context $context,
        StoreManagerInterface $storeManager,
        StorageInterface $storage,
        ScopeConfigInterface $scopeConfig,
        Data $dataHelper,
        Export $export,
        ShipNotify $shipNotify,
        RedirectFactory $redirectFactory
    ) {
        parent::__construct($context);

        $this->storeManager = $storeManager;
        $this->storage = $storage;
        $this->scopeConfig = $scopeConfig;
        $this->dataHelper = $dataHelper;
        $this->export = $export;
        $this->shipNotify = $shipNotify;
        $this->redirectFactory = $redirectFactory;
    }

    /**
     * @inheritDoc
     */
    public function createCsrfValidationException(
        RequestInterface $request
    ): ?InvalidRequestException {
        return null;
    }

    /**
     * @inheritDoc
     */
    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }

    /**
     * Default function
     *
     * @return bool
     * @throws \Magento\Framework\Exception\NoSuchEntityException
     */
    public function execute()
    {
        /** @var $request \Magento\Framework\App\Request\Http */
        $request = $this->getRequest();

        $authUser = $request->getParam('SS-UserName');
        $authPassword = $request->getParam('SS-Password');

        $apiKey = $this->scopeConfig->getValue(
            'shipstation_general/shipstation/ship_api_key'
        );

        $apiKeyFromShipStation = $request->getHeader('ShipStation-Access-Token');

        $apiKeyHasBeenGenerated = !empty($apiKey);
        $apiKeyHasBeenProvided = !empty($apiKeyFromShipStation);

        if ($apiKeyHasBeenGenerated
            && $apiKeyHasBeenProvided
            && ($apiKeyFromShipStation === $apiKey)) {
            $userAuthentication = true;
        } else {
            $userAuthentication = $this->storage->authenticate(
                $authUser,
                $authPassword
            );
        }

        if (!$userAuthentication) {
            $this->getResponse()->setHeader('WWW-Authenticate: ', 'Basic realm=ShipStation', true);
            $this->getResponse()->setHeader('Content-Type', 'text/xml; charset=UTF-8', true);

            $result = $this->dataHelper->fault(401, 'Authentication failed');
            $this->getResponse()->setBody($result);
            return false;
        }

        //Get the requested action
        $action = $request->getParam('action');
        try {
            switch ($action) {
                case 'export':
                    $storeId = $this->storeManager->getStore()->getId();
                    $result = $this->export->process($request, $this->getResponse(), $storeId);
                    break;

                case 'shipnotify':
                    $result = $this->shipNotify->process();
                    // if there hasn't been an error then "200 OK" is given
                    break;
            }
        } catch (Exception $fault) {
            $result = $this->dataHelper->fault($fault->getCode(), $fault->getMessage());
        }

        $this->getResponse()->setBody($result);
    }
}

Anyone know about disturbance with notification when using Varnish cache?

Fix above works for me,
however only for manual notification. (1 auto per day works)

PS. This extension shouldn't be in Magento Marketplace.

@jackrevate, I figured out what is going on with my Magento 2.3.4 instance and Auctane 2.1.24.

Turns out an extension was creating the problem.

Executive summary:

1. Auctane 2.1.24 should work out-of box
2. The patch posted by @Hailong is a better approach
3. If neither work, check extensions, especially those that have overly broad influence on requests and routing (like Auctane!).

As I mentioned, Auctane 2.1.24 includes an alternate approach to the CsrfAwareActionInterface issue. Rather than set the controller to implement this interface, it registers a Plugin for Magento\Framework\App\Request\CsrfValidator that filters every CsrfAwareActionInterface implementer and skips validation only for Auctane's controller.

After disabling Auctane's plugin and updating the controller to directly implement CsrfAwareActionInterface I still could not get my POSTs to pass validation as expected. I then checked some other POST handlers and when they didn't work I realized that there was something interfering at a broader level.

When simulated, all of these requests were being redirected (302) to the homepage with a formKey error message.

I finally tracked the problem down to an extension that was intercepting every request for its own purposes and then forwarding them in a way that broke the CsrfAwareActionInterface logic:

return $this->actionFactory->create('Magento\Framework\App\Action\Forward', ['request' => $request]);

For whatever reason this causes the test for CsrfAwareActionInterface in Magento\Framework\App\Request\CsrfValidator::createException to fail.

Still having this issue, currently using 2.3.5-p1 - so sad Ship Station don't sort a solid release.

@jackrevate, I figured out what is going on with my Magento 2.3.4 instance and Auctane 2.1.24.

Turns out an extension was creating the problem.

Executive summary:

1. Auctane 2.1.24 should work out-of box
2. The patch posted by @Hailong is a better approach
3. If neither work, check extensions, especially those that have overly broad influence on requests and routing (like Auctane!).

As I mentioned, Auctane 2.1.24 includes an alternate approach to the CsrfAwareActionInterface issue. Rather than set the controller to implement this interface, it registers a Plugin for Magento\Framework\App\Request\CsrfValidator that filters every CsrfAwareActionInterface implementer and skips validation only for Auctane's controller.

After disabling Auctane's plugin and updating the controller to directly implement CsrfAwareActionInterface I still could not get my POSTs to pass validation as expected. I then checked some other POST handlers and when they didn't work I realized that there was something interfering at a broader level.

When simulated, all of these requests were being redirected (302) to the homepage with a formKey error message.

I finally tracked the problem down to an extension that was intercepting every request for its own purposes and then forwarding them in a way that broke the CsrfAwareActionInterface logic:

return $this->actionFactory->create('Magento\Framework\App\Action\Forward', ['request' => $request]);

For whatever reason this causes the test for CsrfAwareActionInterface in Magento\Framework\App\Request\CsrfValidator::createException to fail.

I think I must be using an extension that's causing an issue. Although, I've disabled all third party extensions and it still doesn't update. (I even tried to use Royal Mail and other courier extensions but it seems that no matter what I use, it just doesn't update the status).

May I ask what extension was conflicting? Also, any particular extensions I should look into that could cause a conflict?

Thanks,

In the instance I was investigating, Lof_Formbuilder v1.0.9 was causing the issue. It was installed long ago and not used or maintained, so it could be that current versions are fine.

The root of the problem is that this extension was intercepting all requests, filtering them for its own purporses, and then forwarding everything. The forwarded requests were altered in a way that was not compatible with Magento's CsrfAwareActionInterface processing.

I would look for anything that might be intercepting requests, e.g. Observers and Plugins, and try to determine if they are casting a wider net than necessary. With 20/20 hindsight, searching all 3rd party extension for "Magento\Framework\App\Action\Forward" would have flagged the potentially problematic extensions. There are multiple others in my case, but the one causing the issue was the only one that didn't test the request to make sure it was relevant to the extension's specific goals.

Can we just make this a PR into the original ShipStation Plugin?

https://github.com/shipstation/plugin-magento

Just installed the latest plugin (2.1.24) with Magento 2.3.3 - and broken out of the box - no shipment object created. Verified with a ShipStation Support Agent that indeed there are no errors being sent back to them during shipnotify. Even when there was indeed an issue on the Magento side for creating a shipment object. I doubt that the current iteration of the plugin works with Magento 2.3.3 out of the box without this patch. But will see and edit this post if indeed this patch with CSRF fixes creating a shipment object.

@VDuda, I have just created a PR with this patch. https://github.com/shipstation/plugin-magento/pull/6/files

Nice! I for some reason still can't seem to get the shipstation plugin to work on our end even with the CSRF patch. No errors and the customer agent reaffirms that no error message was sent back to them. But I never got a shipment object created! I think I'm just gonna dump them until this plugin actually works :/

I'm going to test for a few more days - it seems to be working with the patch. I had forgotten to turn the cronjobs on after applying this patch. I tend to turn them off during upgrading.