Opencart 2.0.1.1 - 'Status=INVALID StatusDetail= Cannot match the MD5 Hash. Order might be tampered with.'

Question

We're attempting to use the SagePay Server functionality inside Opencart, when making a purchase via this route (and selecting PayPal), we are getting this error response:

Status=INVALID StatusDetail= Cannot match the MD5 Hash. Order might be tampered with.

This is occurring at line 346 in /catalog/controller/payment/sagepay_server.php

Note, the transaction is still actually successful - but it's just the user is not returned back properly to the site. The screen the user sees states:

Server Error 5006: Unable to redirect to Vendor's web site. The vendor failed to provide a RedirectionURL.

Has anybody came across this error before? There is a lot of information about the 5006 error, but it seems the route of our issue is the MD5 Hash not being matched.

Any help is greatly appreciated!

Answer 1

The VPSSignature you generate via the MD5 Hash must match the VPSSignature generated by Sage Pay. Ensure the information returned by Sage Pay matches up with the contents of string being but through the MD5 Hash.

Answer 2

Check for if you are using the Suhosin security extension, as there is the setting suhosin.get.max_value_length that is defaulted to 512. As the md5 hash is passed in the URL, if the total characters of the URL exceeds 512, it is truncated, therefore causing a mismatch of the string.