Security Patch

bitpay/bp_lib.php

@@ -126,7 +126,12 @@ function bpVerifyNotification($apiKey = false) {
 		return array('error' => 'authentication failed (bad hash)');
 	$json['posData'] = $posData['posData'];
 
-	return $json;
+	if (!array_key_exists('id', $json))
+        {
+            return 'Cannot find invoice ID';
+        }
+
+        return bpGetInvoice($json['id'], $apiKey);
 }
 
 // $options can include ('apiKey')
@@ -140,7 +145,10 @@ function bpGetInvoice($invoiceId, $apiKey=false) {
 		return array('error' => $response); 
 	//decode posData
 	$response['posData'] = json_decode($response['posData'], true);
-	$response['posData'] = $response['posData']['posData'];
+	if($bpOptions['verifyPos'])
+        {
+            $response['posData'] = $response['posData']['posData'];
+        }
 
 	return $response;	
 }