Version bump 0.1.0

app/controllers/qbo_controller.rb

@@ -11,6 +11,8 @@
 class QboController < ApplicationController
   unloadable
   
+  require 'openssl'
+  
   include AuthHelper
   
   before_filter :require_user, :except => :qbo_webhook
@@ -64,41 +66,52 @@ class QboController < ApplicationController
   # Quickbooks Webhook Callback
   def qbo_webhook
     
-    if request.headers['Content-Type'] == 'application/json'
-      data = JSON.parse(request.body.read)
-    else
-      # application/x-www-form-urlencoded
-      data = params.as_json
-    end
-    # Process the information
-    entities = data['eventNotifications'][0]['dataChangeEvent']['entities']
-    entities.each do |entity|
-      id = entity['id'].to_i
-      name = entity['name']
-      
-      # TODO rename all other models!
-      name.prepend("Qbo") if not name.eql? "Customer"
-      
-      # Magicly initialize the correct class
-      obj = name.constantize
-      
-      # for merge events
-      obj.delete(entity['deletedId']) if entity['deletedId']
-      
-      #Check to see if we are deleting a record
-      if entity['operation'].eql? "Delete"
-          obj.delete(id)
-      #if not then update!
+    # check the payload
+    signature = request.headers['intuit-signature']
+    key = Setting.plugin_redmine_qbo['settingsWebhookToken']
+    data = request.body.read
+    hash = Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha256'), key, data)).strip()
+    
+    # proceed if the request is good
+    if hash.eql? signature
+      if request.headers['content-type'] == 'application/json'
+        data = JSON.parse(data)
       else
-        obj.sync_by_id(id)
+        # application/x-www-form-urlencoded
+        data = params.as_json
       end
+      # Process the information
+      entities = data['eventNotifications'][0]['dataChangeEvent']['entities']
+      entities.each do |entity|
+        id = entity['id'].to_i
+        name = entity['name']
+        
+        # TODO rename all other models!
+        name.prepend("Qbo") if not name.eql? "Customer"
+        
+        # Magicly initialize the correct class
+        obj = name.constantize
+        
+        # for merge events
+        obj.destroy(entity['deletedId']) if entity['deletedId']
+        
+        #Check to see if we are deleting a record
+        if entity['operation'].eql? "Delete"
+            obj.destroy(id)
+        #if not then update!
+        else
+          obj.sync_by_id(id)
+        end
+      end
+      
+      # Record that last time we updated
+      Qbo.update_time_stamp
+      
+      # The webhook doesn't require a response but let's make sure we don't send anything
+      render :nothing => true
+    else
+      render nothing: true, status: 400
     end
-    
-    # Record that last time we updated
-    Qbo.update_time_stamp
-    
-    # The webhook doesn't require a response but let's make sure we don't send anything
-    render :nothing => true
   end
 
   #

app/views/qbo/_settings.html.erb

@@ -46,6 +46,15 @@ intuit.ipp.anywhere.setup({menuProxy: '/path/to/blue-dot', grantUrl: '<%= qbo_au
                            name="settings[settingsOAuthConsumerSecret]" >
       </td>
     </tr>
+    
+    <tr>
+      <th>Intuit QBO Webhook Token</th>
+      <td>
+        <input type="text" style="width:350px" id="settingsWebhookToken"
+                           value="<%= settings['settingsWebhookToken'] %>"
+                           name="settings[settingsWebhookToken]" >
+      </td>
+    </tr>
 
      <tr>
        <th>Token Expires At</th>

init.rb

@@ -25,7 +25,7 @@ Redmine::Plugin.register :redmine_qbo do
     name 'Redmine Quickbooks Online plugin'
     author 'Rick Barrette'
     description 'This is a plugin for Redmine to intergrate with Quickbooks Online to allow for seamless intergration CRM and invoicing of completed issues'
-    version '0.0.8'
+    version '0.1.0'
     url 'https://github.com/rickbarrette/redmine_qbo'
     author_url 'http://rickbarrette.org'
     settings :default => {'empty' => true}, :partial => 'qbo/settings'

lib/issues_show_hook_listener.rb

@@ -50,6 +50,8 @@ class IssuesShowHookListener < Redmine::Hook::ViewListener
       #do nothing
     end
     
+    split_vin = vin.scan(/.{1,9}/) if vin
+    
     return "
     <div class=\"attributes\">
     
@@ -82,7 +84,7 @@ class IssuesShowHookListener < Redmine::Hook::ViewListener
         
       <div class=\"vehicle_vin attribute\">
         <div class=\"label\"><span>VIN</span>:</div>
-        <div class=\"value\">#{vin.gsub(/(.{9})/, '\1 ') if vin}</div>
+        <div class=\"value\">#{split_vin[0] if split_vin}<b>#{split_vin[1] if split_vin}</b></div>
       </div>
       
       <div class=\"vehicle_notes attribute\">