mschindler83/fints-hbci-php

Special Characters are not Invalidated Before Transmission

MaximilianKoestler opened this issue · 0 comments

My bank sometimes issues dialog ids starting with a + sign.

The dialog id in the bank's response then looks like this:

HNHBK: ... +?+ABCDEFGHIJK ... (Bank -> fints-hbci-php)

As you can see, the + is escaped (invalidated) with a prefix ? in the message from the bank.
However, once this id gets used by fints-hbci-php in the next message, it is not properly escaped.

Therefore, two consecutive + signs occur in the message which gets rejected by the bank:

HNHBK: ... ++ABCDEFGHIJK ... (fints-hbci-php -> Bank)

when it should send:

HNHBK: ... +?+ABCDEFGHIJK ... (fints-hbci-php -> Bank)

I have fixed this on my end in the Dialog.php during the initial processing of the dialog id.

This is obviously not the proper place to put this fix, since it might also be relevant for other message elements.
When I tried a simple fix in the AbstractSegment.php I broke some parts because I apparently also escaped + signs that I should not have, but I currently have no time for a deeper investigation.