Fix for plus signs in data and verified array

php/PaypalIPN.php

@@ -63,7 +63,7 @@ public function getPaypalUri()
      * Verification Function
      * Sends the incoming post data back to PayPal using the cURL library.
      *
-     * @return bool
+     * @return array or false
      * @throws Exception
      */
     public function verifyIPN()
@@ -75,31 +75,31 @@ public function verifyIPN()
         $raw_post_data = file_get_contents('php://input');
         $raw_post_array = explode('&', $raw_post_data);
         $myPost = array();
+        $magic_quotes_enabled = false;
+        if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc() == 1) {
+            $magic_quotes_enabled = true;
+        }
         foreach ($raw_post_array as $keyval) {
             $keyval = explode('=', $keyval);
             if (count($keyval) == 2) {
-                // Since we do not want the plus in the datetime string to be encoded to a space, we manually encode it.
-                if ($keyval[0] === 'payment_date') {
-                    if (substr_count($keyval[1], '+') === 1) {
-                        $keyval[1] = str_replace('+', '%2B', $keyval[1]);
+                // Since we do not want the plus signs in the date and email strings to be encoded to a space, we use rawurldecode instead of urldecode
+                if (($keyval[0] === 'payment_date' && substr_count($keyval[1], '+') === 1) || strpos(rawurldecode($keyval[1]), ' ') !== false || ($_POST["test_ipn"] == 1 && filter_var($keyval[1], FILTER_VALIDATE_EMAIL))) {
+                    // Keep plus signs
+                    $myPost[$keyval[0]] = rawurldecode($keyval[1]);
+                } else {
+                    // Convert plus signs to spaces
+                    $myPost[$keyval[0]] = urldecode($keyval[1]);
+                    if ($magic_quotes_enabled) {
+                        $myPost[$keyval[0]] = stripslashes($myPost[$keyval[0]]);
                     }
                 }
-                $myPost[$keyval[0]] = urldecode($keyval[1]);
             }
         }
 
         // Build the body of the verification post request, adding the _notify-validate command.
         $req = 'cmd=_notify-validate';
-        $get_magic_quotes_exists = false;
-        if (function_exists('get_magic_quotes_gpc')) {
-            $get_magic_quotes_exists = true;
-        }
         foreach ($myPost as $key => $value) {
-            if ($get_magic_quotes_exists == true && get_magic_quotes_gpc() == 1) {
-                $value = urlencode(stripslashes($value));
-            } else {
-                $value = urlencode($value);
-            }
+            $value = rawurlencode($value);
             $req .= "&$key=$value";
         }
 
@@ -136,11 +136,10 @@ public function verifyIPN()
 
         curl_close($ch);
 
-        // Check if PayPal verifies the IPN data, and if so, return true.
+        // Check if PayPal verifies the IPN data, and if so, return data array.
         if ($res == self::VALID) {
-            return true;
-        } else {
-            return false;
+            return $myPost;
         }
+        return false;
     }
 }