MDL-38408 always validate PayPal dates and cost, improve float formatting

enrol/paypal/edit.php

@@ -47,6 +47,7 @@ $plugin = enrol_get_plugin('paypal');
 
 if ($instanceid) {
     $instance = $DB->get_record('enrol', array('courseid'=>$course->id, 'enrol'=>'paypal', 'id'=>$instanceid), '*', MUST_EXIST);
+    $instance->cost = format_float($instance->cost, 2, true);
 } else {
     require_capability('moodle/course:enrolconfig', $context);
     // no instance yet, we have to add new instance

enrol/paypal/edit_form.php

@@ -46,7 +46,7 @@ class enrol_paypal_edit_form extends moodleform {
 
         $mform->addElement('text', 'cost', get_string('cost', 'enrol_paypal'), array('size'=>4));
         $mform->setType('cost', PARAM_RAW); // Use unformat_float to get real value.
-        $mform->setDefault('cost', $plugin->get_config('cost'));
+        $mform->setDefault('cost', format_float($plugin->get_config('cost'), 2, true));
 
         $paypalcurrencies = $plugin->get_currencies();
         $mform->addElement('select', 'currency', get_string('currency', 'enrol_paypal'), $paypalcurrencies);
@@ -90,15 +90,13 @@ class enrol_paypal_edit_form extends moodleform {
 
         list($instance, $plugin, $context) = $this->_customdata;
 
-        if ($data['status'] == ENROL_INSTANCE_ENABLED) {
-            if (!empty($data['enrolenddate']) and $data['enrolenddate'] < $data['enrolstartdate']) {
-                $errors['enrolenddate'] = get_string('enrolenddaterror', 'enrol_paypal');
-            }
+        if (!empty($data['enrolenddate']) and $data['enrolenddate'] < $data['enrolstartdate']) {
+            $errors['enrolenddate'] = get_string('enrolenddaterror', 'enrol_paypal');
+        }
 
-            if (!is_numeric($data['cost'])) {
-                $errors['cost'] = get_string('costerror', 'enrol_paypal');
-
-            }
+        $cost = str_replace(get_string('decsep', 'langconfig'), '.', $data['cost']);
+        if (!is_numeric($cost)) {
+            $errors['cost'] = get_string('costerror', 'enrol_paypal');
         }
 
         return $errors;

enrol/paypal/enrol.html

@@ -2,7 +2,7 @@
 
 <p><?php print_string("paymentrequired") ?></p>
 <p><b><?php echo $instancename; ?></b></p>
-<p><b><?php echo get_string("cost").": {$instance->currency} {$cost}"; ?></b></p>
+<p><b><?php echo get_string("cost").": {$instance->currency} {$localisedcost}"; ?></b></p>
 <p><img alt="<?php print_string('paypalaccepted', 'enrol_paypal') ?>" src="https://www.paypal.com/en_US/i/logo/PayPal_mark_60x38.gif" /></p>
 <p><?php print_string("paymentinstant") ?></p>
 <?php

enrol/paypal/ipn.php

@@ -197,8 +197,10 @@ if (strlen($result) > 0) {
             $cost = (float) $plugin_instance->cost;
         }
 
+        // Use the same rounding of floats as on the enrol form.
+        $cost = format_float($cost, 2, false);
+
         if ($data->payment_gross < $cost) {
-            $cost = format_float($cost, 2);
             message_paypal_error_to_admin("Amount paid is not enough ($data->payment_gross < $cost))", $data);
             die;
 

enrol/paypal/lib.php

@@ -190,6 +190,11 @@ class enrol_paypal_plugin extends enrol_plugin {
             echo '<p>'.get_string('nocost', 'enrol_paypal').'</p>';
         } else {
 
+            // Calculate localised and "." cost, make sure we send PayPal the same value,
+            // please note PayPal expects amount with 2 decimal places and "." separator.
+            $localisedcost = format_float($cost, 2, true);
+            $cost = format_float($cost, 2, false);
+
             if (isguestuser()) { // force login only for guest user, not real users with guest role
                 if (empty($CFG->loginhttps)) {
                     $wwwroot = $CFG->wwwroot;
@@ -199,7 +204,7 @@ class enrol_paypal_plugin extends enrol_plugin {
                     $wwwroot = str_replace("http://", "https://", $CFG->wwwroot);
                 }
                 echo '<div class="mdl-align"><p>'.get_string('paymentrequired').'</p>';
-                echo '<p><b>'.get_string('cost').": $instance->currency $cost".'</b></p>';
+                echo '<p><b>'.get_string('cost').": $instance->currency $localisedcost".'</b></p>';
                 echo '<p><a href="'.$wwwroot.'/login/">'.get_string('loginsite').'</a></p>';
                 echo '</div>';
             } else {