callback_redirect_form_validate.module.php

/**
 * Implements callback_redirect_form().
 */
function commerce_monogram_redirect_form($form, &$form_state, $order, $payment_method) {
  $wrapper = entity_metadata_wrapper('commerce_order', $order);
  
  switch ($payment_method['method_id']) {
    case 'monogram_tatrapay_tb':
      break;
    case 'monogram_eplatby_vub':
      // redirect URL na platobnu branu
      $form['#action'] = COMMERCE_MONOGRAM_VUB_EPLATBY_REDIRECT_URL;
      // data zasielane POST/GET metodou
      $data = array(
        'MID'  => COMMERCE_MONOGRAM_VUB_EPLATBY_MID,
        'AMT'  => commerce_currency_amount_to_decimal($wrapper->commerce_order_total->amount->value(), $wrapper->commerce_order_total->currency_code->value()),
        'VS'   => $order->order_id,
        'CS'   => '0308',
        'RURL' => url('checkout/' . $order->order_id . '/payment/return/' . $order->data['payment_redirect_key'], array('absolute' => TRUE)),
      );
      // kontrolny sucet pre data 
      $data['SIGN'] = CalculateSIGN_HMACSHA256(implode($data), COMMERCE_MONOGRAM_VUB_EPLATBY_HMAC_PASSWORD);
      break;
  }

  // skryte formularove prvky s datami
  foreach ($data as $name => $value) {
    $form[$name] = array('#type' => 'hidden', '#value' => $value);  
  }
  
  // callback ktory pred vyrenderovanim formularu odstrani neziaduce data
  $form['#pre_render'][] = 'commerce_monogram_clean_form';
  
  $form['submit'] = array(
    '#type' => 'submit',
    '#value' => 'Prejsť na platobnú bránu ' . $payment_method['title'],
    // dolezite! vymaze meno a preto sa hodnota neposle do POST
    '#name' => '',
  );  

  return $form;
}

/**
 * Implements callback_redirect_form_validate()
 */
function commerce_monogram_redirect_form_validate($order, $payment_method) {
  switch ($payment_method['method_id']) {
    case 'monogram_tatrapay_tb':
      break;
    case 'monogram_eplatby_vub':
      // return data fields, TRUE znamena ze pole je zahrnute do vypoctu 
      // podpisu pre kontrolu
      $fields = array(
        'VS' => TRUE, 
        'RES' => TRUE, 
        'SIGN' => FALSE,
      );
      
      // ziskame retazec pre ktory budeme pocitat sign
      $string = '';
      foreach ($fields as $field => $flag) {
        if ($flag) $string .= $_GET[$field];
      }
      
      // kontrolny sucet (podpis) pre data 
      $sign = CalculateSIGN_HMACSHA256($string, COMMERCE_MONOGRAM_VUB_EPLATBY_HMAC_PASSWORD);

      // ak su vypocitany podpis a vrateny podpis rovnake su vratene udaje 
      // doveryhodne 
      if ($sign === $_GET['SIGN']) {
        switch ($_GET['RES']) {
          // platbu mozeme pokladat za zrealizovanu
          case 'OK':
            return TRUE;
            break;
          // v procese platby na brane nastala nejaka chyba
          case 'FAIL':
          case 'NA':
            return FALSE;
            break;
        }
      }
      break;
  }
  
  // nejaka ina chyba
  return FALSE;
}