PayPal X-Frame issue

-- HikaShop version -- : 4.3.0
-- Joomla version -- : 3.9.23

Hello,
I have an issue with the Hikashop Paypal Website Payments Pro Hosted Payment plugin. I have it published and active on my site, when I go through the checkout process and select it as a payment option it fails with an x-frame cross scripting issue. I cannot get the plugin to work with either run in iFrame Yes or No setting.

Please see the attached screenshots. Does anyone have the PayPal Hosted plugin running successfully? Can you advise on how you have the configuration setup.

Thanks
Lee

Thanks for the reply. I have been in touch with PayPal who may have found an issue. This is the reply from their support team (I have redacted some of the information and replaced with XXXXXXXX):

So I have taken the code and tested and this is what is getting send over to PayPal:

<form id=paypal
target=hss_iframe
name="name=hikashop_paypalintegralevolution_form"
action=https://securepayments.paypal.com/webapps/HostedSoleSolutionApp/webflow/sparta/hostedSoleSolutionProcess method=post>

<input type=hidden name=cmd value=_ext-enter>
<input type=hidden name=redirect_cmd value=_hosted-payment>
<input type=hidden name=upload value=1>
<input type=hidden name=business value=XXXXXXXX>
<input type=hidden name=receiver_email value=XXXXXXXX>
<input type=hidden name=invoice value=53433>
<input type=hidden name=currency_code value=GBP>
<input type=hidden name=return value=XXXXXXXX>
<input type=hidden name=notify_url value=XXXXXXXX>
<input type=hidden name=cancel_return value=XXXXXXXX>
<input type=hidden name=test_ipn value=0>
<input type=hidden name=shipping value=15>
<input type=hidden name=charset value=utf-8>
<input type=hidden name=bn value=HikariSoftware_Cart_WPS>
<input type=hidden name=address_override value=0>
<input type=hidden name=billing_first_name value=XXXXXXXX>
<input type=hidden name=billing_last_name value=XXXXXXXX>
<input type=hidden name=billing_address1 value=XXXXXXXX>
<input type=hidden name=billing_address2 value=XXXXXXXX>
<input type=hidden name=billing_zip value=XXXXXXXX>
<input type=hidden name=billing_city value=XXXXXXXX>
<input type=hidden name=billing_state value=XXXXXXXX>
<input type=hidden name=billing_country value=XXXXXXXX>
<input type=hidden name=email value=XXXXXXXX>
<input type=hidden name=night_phone_b value=XXXXXXXX>
<input type=hidden name=subtotal value=XXXXXXXX>
<input type=hidden name=tax value=3>
<input type=hidden name=template value=templateD>
</form>

When I tested the above code this didn’t work for me. The main culprit for this was the variable “name”

name=”hikashop_paypalintegralevolution_form”

renaming it to:

name="paypal_form"

Allowed the Iframe to Generate

Nicolas,
Firstly thank you for your help it is greatly appreciated.

PayPal have replied with a possible issue / solution:

Thanks for the information there, and the code snippet. So looking at the code I can see the issue straight away:
 
<?php
if (($this->payment_params->iframe == 1)) {
?>
 
<iframe  frameborder="0" id="hss_iframe" name="hss_iframe" width="570px" height="540px"></iframe>
 
 
//<div class="hikashop_paypalintegralevolution_end" id="hikashop_paypalintegralevolution_end">
//<form id="hikashop_paypalintegralevolution_form" target="hss_iframe" //name="hikashop_paypalintegralevolution_form" action="<?php echo $this->payment_params->url;?>" //method="post">
 
Looks like the HSS Iframe is being loaded into: (payment_paramsàiframe ==1 ) This would automatically trigger a security issue and result in the refuse to display error. If you take the code directly out of that environment and run it within a local host the Iframe will render without any issues. Wrapping the Iframe in a div container shouldn’t be an issue, however wrapping the Iframe within another Iframe will cause the origin conflict.

Nicolas,
PayPal are saying it has to run in iFrame mode.

I'm getting nowhere! this is beyond what I understand. It seems PayPal were able to get it working when they edited the page code, please see the attcahed PDF which is a copy of an email they sent to me.

Does this make any more sense? It seems they can get it working in an iFrame which is what they are requesting needs to be done?

Thanks

Lee