Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This gem adds robokassa support to your app.
Robokassa is payment system, that provides a single simple interface for payment systems popular in Russia. If you have customers in Russia you can use the gem.
The first thing about this gem, is that it was oribinally desgned for spree commerce. So keep it im mind.
Данный джем является форком джема: https://github.com/shaggyone/robokassa
Add the following line to your app Gemfile
gem 'robokassa'
Update your bundle
bundle install
config/initializers/robokassa.rb:
ROBOKASSA_SETTINGS = {
:test_mode => true,
:login => 'LOGIN',
:password1 => 'PASSWORD1',
:password2 => 'PASSWORD2'
}
$robokassa = Robokassa::Interface.new(ROBOKASSA_SETTINGS)
module Robokassa
class Interface
def notify_implementation(invoice_id, *args); end
class << self
def get_options_by_notification_key(key)
ROBOKASSA_SETTINGS
end
def success_implementation(invoice_id, *args)
payment = Payment.find_by_id(invoice_id)
payment.to_success!
end
def fail_implementation(invoice_id, *args)
payment = Payment.find_by_id(invoice_id)
payment.to_fail!
end
end
end
end
routes.rb:
mount Robokassa::Engine => "/robokassa", :as => "robokassa"
app/controllers/dashboard/payments_controller.rb:
class Dashboard::PaymentsController < Dashboard::ApplicationController
...
def create
@payment = current_user.payments.create!(:amount => params[:payment][:amount])
pay_url = $robokassa.init_payment_url(
@payment.id, @payment.amount, "Платеж № #{@payment.id}",
'', 'ru', current_user.email, {}
)
redirect_to pay_url
end
...
app/models/payment.rb:
class Payment < ActiveRecord::Base
include AASM
validates_presence_of :user_id, :amount
attr_accessible :amount
belongs_to :user
default_scope order("id desc")
aasm do
state :new, :initial => true
state :success
state :fail
event :to_success, :after => :give_money! do
transitions :to => :success
end
event :to_fail do
transitions :to => :fail
end
end
def state
self.aasm_state
end
def give_money!
self.user.give_money!(self.amount)
end
def printable_amount
"#{self.amount.to_s} руб."
end
end
app/models/user.rb:
class User < ActiveRecord::Base
...
has_balance
...
dashboarb/payments/_form.html.erb:
<%= semantic_form_for [:dashboard, @payment] do |f| %>
<%= f.error_messages %>
<%= f.input :amount %>
<%= actions_for f, "Пополнить" %>
<% end %>
app/controllers/robokassa.rb:
# coding: utf-8
class RobokassaController < Robokassa::Controller
def success
super
@payment = Payment.find_by_id(params[:InvId])
if @payment
redirect_to dashboard_payment_path(@payment),
:notice => "Ваш платеж на сумму #{@payment.amount.to_s} руб. успешно принят. Спасибо!"
else
redirect_to new_dashboard_payment_path,
:error => "Не могу найти платеж по данному идентификатору"
end
end
def fail
super
redirect_to dashboard_payments_path,
:error => "Во время принятия платежа возникла ошибка. Мы скоро разберемся!"
end
end
In Robokassa account settings set:
Result URL: http://example.com/robokassa/default/notify
Success URL: http://example.com/robokassa/success
Fail URL: http://example.com/robokassa/fail
In console:
Clone gem
git clone git://github.com/shaggyone/robokassa.git
Install gems and generate a dummy application (It'll be ignored by git):
cd robokassa
bundle install
bundle exec combust
Run specs:
rake spec
Generate a dummy test application
I plan to add generators for views
FAQs
Unknown package
We found that robokassa demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.