php example shows order id in fulfillment page

3 files changed, 12 insertions, 17 deletions

diff --git a/php/fulfillment.php b/php/fulfillment.php
index 3c0ecef..ce4174d 100644
--- a/php/fulfillment.php
+++ b/php/fulfillment.php
@@ -7,7 +7,7 @@
 
   if(pull($_SESSION, 'paid', false)){
     echo sprintf("<p>Thanks for your donation!</p>
-                  <br><p>The order ID is: %s; use it to
+                  <br><p>The order ID is: <b>%s</b>; use it to
                   <a href=\"backoffice.html\">track</a> your money,
                   or make <a href=\"/\">another donation!</a></p>",
                   $_SESSION['order_id']);
diff --git a/php/generate-order.php b/php/generate-order.php
index 4d57998..017780f 100644
--- a/php/generate-order.php
+++ b/php/generate-order.php
@@ -5,7 +5,7 @@
   include 'backend.php';
   include 'error.php';
 
-  $order_id = rand(1,90000); // simplified, do not do this!
+  $order_id = "tutorial-" . dechex(rand(0,99999999)) . date("-H_i_s");
   session_start();
   $_SESSION["order_id"] = $order_id;
   // this variable is the JSON of a contract proposal,
diff --git a/php/pay.php b/php/pay.php
index 25b2d6a..921cc70 100644
--- a/php/pay.php
+++ b/php/pay.php
@@ -1,34 +1,29 @@
 <?php
   // This file is in the public domain.
 
-  include 'backend.php';
-  include 'error.php';
+  include "backend.php";
+  include "error.php";
 
   session_start();
-  if(!isset($_SESSION['paid'])){
+  if(!isset($_SESSION["paid"])){
     echo "<p>No session active. Aborting.</p>";
     return;
   }
   // Get coins.
-  $body = json_decode(file_get_contents('php://input'));
-
-  if ($_SESSION["order_id"] != $body->order_id){
-    echo build_error($response,
-                     "Mismatch between the product ordered and the one attempted to be paid",
-                     406);
-    return;
-  }
+  $body = json_decode(file_get_contents("php://input"));
 
   $response = post_to_backend("/pay", $body);
-  http_response_code($response['status_code']);
+  $proposal_data = json_decode($response["body"])->proposal_data;
+  $_SESSION["order_id"] = $proposal_data->order_id;
+  http_response_code($response["status_code"]);
 
-  if (200 != $response['status_code']){
+  if (200 != $response["status_code"]){
     echo build_error($response,
                      "Could not send payment to backend",
-                     $response['status_code']);
+                     $response["status_code"]);
     return;
   }
   // Payment went through!
-  $_SESSION['paid'] = true;
+  $_SESSION["paid"] = true;
   return;
 ?>