Fix ShipStation plugin for Magento 2.3

fix-shipstation-plugin-for-magento-2.3.patch

From 15db78fd75a7fc473d72157cb952f36739b125c7 Mon Sep 17 00:00:00 2001
From: Hailong Zhao <[email protected]>
Date: Sat, 13 Apr 2019 23:13:58 -0400
Subject: [PATCH] Fix ShipStation plugin.

---
 .../Auctane/Api/Controller/Auctane/Index.php  | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/app/code/Auctane/Api/Controller/Auctane/Index.php b/app/code/Auctane/Api/Controller/Auctane/Index.php
index 53f9664f..a3319f17 100644
--- a/app/code/Auctane/Api/Controller/Auctane/Index.php
+++ b/app/code/Auctane/Api/Controller/Auctane/Index.php
@@ -2,9 +2,29 @@
 namespace Auctane\Api\Controller\Auctane;
 
 use Exception;
+use Magento\Framework\App\CsrfAwareActionInterface;
+use Magento\Framework\App\Request\InvalidRequestException;
+use Magento\Framework\App\RequestInterface;
 
-class Index extends \Magento\Framework\App\Action\Action
+class Index extends \Magento\Framework\App\Action\Action implements CsrfAwareActionInterface
 {
+    /**
+     * @inheritDoc
+     */
+    public function createCsrfValidationException(
+        RequestInterface $request
+    ): ?InvalidRequestException {
+        return null;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function validateForCsrf(RequestInterface $request): ?bool
+    {
+        return true;
+    }
+
     /**
      * Default function
      *
-- 
2.20.1 (Apple Git-117)

Index.php

<?php
namespace Auctane\Api\Controller\Auctane;

use Exception;
use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;

class Index extends \Magento\Framework\App\Action\Action implements CsrfAwareActionInterface
{
    /**
     * @inheritDoc
     */
    public function createCsrfValidationException(
        RequestInterface $request
    ): ?InvalidRequestException {
        return null;
    }

    /**
     * @inheritDoc
     */
    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }

    /**
     * Default function
     *
     * @return void
     */
    public function execute()
    {
        $authUser = $this->getRequest()->getParam('SS-UserName');
        $authPassword = $this->getRequest()->getParam('SS-Password');

        // \Magento\Store\Model\StoreManagerInterface $storeManager
        $storeManager = $this->_objectManager->get(
            'Magento\Store\Model\StoreManagerInterface'
        );
        $storeId = $storeManager->getStore()->getId();

        $storageInterface = $this->_objectManager->get(
            '\Magento\Backend\Model\Auth\Credential\StorageInterface'
        );
        $userAuthentication = $storageInterface->authenticate(
            $authUser,
            $authPassword
        );

        $dataHelper = $this->_objectManager->get('Auctane\Api\Helper\Data');
        if (!$userAuthentication) {
            header(sprintf('WWW-Authenticate: Basic realm=ShipStation'));
            $result = $dataHelper->fault(401, 'Authentication failed');
            header('Content-Type: text/xml; charset=UTF-8');
            $this->getResponse()->setBody($result);
            return false;
        }

        //Get the requested action
        $action = $this->getRequest()->getParam('action');
        try {
            switch ($action) {
                case 'export':
                    $export = $this->_objectManager->get(
                        'Auctane\Api\Model\Action\Export'
                    );
                    $result = $export->process($this->getRequest(), $storeId);
                    break;

                case 'shipnotify':
                    $shipNotify = $this->_objectManager->get(
                        'Auctane\Api\Model\Action\ShipNotify'
                    );
                    $result = $shipNotify->process($this->getRequest());
                    // if there hasn't been an error then "200 OK" is given
                    break;
            }
        } catch (Exception $fault) {
            $result = $dataHelper->fault($fault->getCode(), $fault->getMessage());
        }

        $this->getResponse()->setBody($result);
    }
}

Patch file for ShipStation 2.1.24

From d922c449c13246f370c66865ad2714f7f2fe4a8e Mon Sep 17 00:00:00 2001
From: Hailong Zhao <[email protected]>
Date: Wed, 8 Apr 2020 22:21:41 -0400
Subject: [PATCH] Patch for ShipStation 2.1.24

---
 Index.php | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/Index.php b/Index.php
index da9748a..b64be58 100644
--- a/Index.php
+++ b/Index.php
@@ -10,10 +10,13 @@ use Magento\Backend\Model\Auth\Credential\StorageInterface;
 use Magento\Backend\Model\View\Result\RedirectFactory;
 use Magento\Framework\App\Action\Action;
 use Magento\Framework\App\Action\Context;
+use Magento\Framework\App\CsrfAwareActionInterface;
+use Magento\Framework\App\Request\InvalidRequestException;
+use Magento\Framework\App\RequestInterface;
 use Magento\Framework\App\Config\ScopeConfigInterface;
 use Magento\Store\Model\StoreManagerInterface;
 
-class Index extends Action
+class Index extends Action implements CsrfAwareActionInterface
 {
     /**
      * @var StoreManagerInterface
@@ -65,6 +68,23 @@ class Index extends Action
         $this->redirectFactory = $redirectFactory;
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function createCsrfValidationException(
+        RequestInterface $request
+    ): ?InvalidRequestException {
+        return null;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function validateForCsrf(RequestInterface $request): ?bool
+    {
+        return true;
+    }
+
     /**
      * Default function
      *
-- 
2.24.1 (Apple Git-126)

Patched Index.php of ShipStation 2.1.24

<?php

namespace Auctane\Api\Controller\Auctane;

use Auctane\Api\Helper\Data;
use Auctane\Api\Model\Action\Export;
use Auctane\Api\Model\Action\ShipNotify;
use Exception;
use Magento\Backend\Model\Auth\Credential\StorageInterface;
use Magento\Backend\Model\View\Result\RedirectFactory;
use Magento\Framework\App\Action\Action;
use Magento\Framework\App\Action\Context;
use Magento\Framework\App\CsrfAwareActionInterface;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;
use Magento\Framework\App\Config\ScopeConfigInterface;
use Magento\Store\Model\StoreManagerInterface;

class Index extends Action implements CsrfAwareActionInterface
{
    /**
     * @var StoreManagerInterface
     */
    private $storeManager;
    /**
     * @var StorageInterface
     */
    private $storage;
    /**
     * @var ScopeConfigInterface
     */
    private $scopeConfig;
    /**
     * @var Data
     */
    private $dataHelper;
    /**
     * @var Export
     */
    private $export;
    /**
     * @var ShipNotify
     */
    private $shipNotify;
    /**
     * @var RedirectFactory
     */
    private $redirectFactory;

    public function __construct(
        Context $context,
        StoreManagerInterface $storeManager,
        StorageInterface $storage,
        ScopeConfigInterface $scopeConfig,
        Data $dataHelper,
        Export $export,
        ShipNotify $shipNotify,
        RedirectFactory $redirectFactory
    ) {
        parent::__construct($context);

        $this->storeManager = $storeManager;
        $this->storage = $storage;
        $this->scopeConfig = $scopeConfig;
        $this->dataHelper = $dataHelper;
        $this->export = $export;
        $this->shipNotify = $shipNotify;
        $this->redirectFactory = $redirectFactory;
    }

    /**
     * @inheritDoc
     */
    public function createCsrfValidationException(
        RequestInterface $request
    ): ?InvalidRequestException {
        return null;
    }

    /**
     * @inheritDoc
     */
    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }

    /**
     * Default function
     *
     * @return bool
     * @throws \Magento\Framework\Exception\NoSuchEntityException
     */
    public function execute()
    {
        /** @var $request \Magento\Framework\App\Request\Http */
        $request = $this->getRequest();

        $authUser = $request->getParam('SS-UserName');
        $authPassword = $request->getParam('SS-Password');

        $apiKey = $this->scopeConfig->getValue(
            'shipstation_general/shipstation/ship_api_key'
        );

        $apiKeyFromShipStation = $request->getHeader('ShipStation-Access-Token');

        $apiKeyHasBeenGenerated = !empty($apiKey);
        $apiKeyHasBeenProvided = !empty($apiKeyFromShipStation);

        if ($apiKeyHasBeenGenerated
            && $apiKeyHasBeenProvided
            && ($apiKeyFromShipStation === $apiKey)) {
            $userAuthentication = true;
        } else {
            $userAuthentication = $this->storage->authenticate(
                $authUser,
                $authPassword
            );
        }

        if (!$userAuthentication) {
            $this->getResponse()->setHeader('WWW-Authenticate: ', 'Basic realm=ShipStation', true);
            $this->getResponse()->setHeader('Content-Type', 'text/xml; charset=UTF-8', true);

            $result = $this->dataHelper->fault(401, 'Authentication failed');
            $this->getResponse()->setBody($result);
            return false;
        }

        //Get the requested action
        $action = $request->getParam('action');
        try {
            switch ($action) {
                case 'export':
                    $storeId = $this->storeManager->getStore()->getId();
                    $result = $this->export->process($request, $this->getResponse(), $storeId);
                    break;

                case 'shipnotify':
                    $result = $this->shipNotify->process();
                    // if there hasn't been an error then "200 OK" is given
                    break;
            }
        } catch (Exception $fault) {
            $result = $this->dataHelper->fault($fault->getCode(), $fault->getMessage());
        }

        $this->getResponse()->setBody($result);
    }
}

Can we just make this a PR into the original ShipStation Plugin?

https://github.com/shipstation/plugin-magento

Just installed the latest plugin (2.1.24) with Magento 2.3.3 - and broken out of the box - no shipment object created. Verified with a ShipStation Support Agent that indeed there are no errors being sent back to them during shipnotify. Even when there was indeed an issue on the Magento side for creating a shipment object. I doubt that the current iteration of the plugin works with Magento 2.3.3 out of the box without this patch. But will see and edit this post if indeed this patch with CSRF fixes creating a shipment object.

@VDuda, I have just created a PR with this patch. https://github.com/shipstation/plugin-magento/pull/6/files

Nice! I for some reason still can't seem to get the shipstation plugin to work on our end even with the CSRF patch. No errors and the customer agent reaffirms that no error message was sent back to them. But I never got a shipment object created! I think I'm just gonna dump them until this plugin actually works :/

I'm going to test for a few more days - it seems to be working with the patch. I had forgotten to turn the cronjobs on after applying this patch. I tend to turn them off during upgrading.